tool-supported program abstraction for finite-state verification matthew dwyer 1, john hatcliff 1,...
DESCRIPTION
Goals of our work … Develop multiple forms of tool support for abstraction that are … … applicable to program source code … largely automated … usable by non-experts Evaluate the effectiveness of this tool support through… … implementation in the Bandera toolset … application to real multi-threaded Java programsTRANSCRIPT
![Page 1: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/1.jpg)
Tool-supported Program Abstraction Tool-supported Program Abstraction for Finite-state Verificationfor Finite-state Verification
Matthew Dwyer1, John Hatcliff1, Corina Pasareanu1, Robby1, Roby Joehanes1, Shawn Laubach1, Willem Visser2, Hongjun Zheng1
Kansas State University1
NASA Ames Research Center/RIACS2http://www.cis.ksu.edu/santos/bandera
![Page 2: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/2.jpg)
Abstraction: the key to scaling upAbstraction: the key to scaling up
Originalsystem
symbolic state
Abstract system
represents a set of states
abstraction
Safety: The set of behaviors of the abstract system over-approximates the set of behaviors of the original system
![Page 3: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/3.jpg)
Goals of our work …Goals of our work …
Develop multiple forms of tool support for abstraction that are …
… applicable to program source code… largely automated… usable by non-experts
Evaluate the effectiveness of this tool support through…
… implementation in the Bandera toolset… application to real multi-threaded Java programs
![Page 4: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/4.jpg)
Case Study: DEOS KernelCase Study: DEOS Kernel
A real-time operating system for integrated modular avionics systems
Large C++ program, manually sliced and inspected Slice translated to Java by NASA Ames
– 1443 lines of code, 20 classes, 6 threads With a known bug
Honeywell Dynamic Enforcement Operating System (DEOS)
Application processes are guaranteed to be scheduled for their budgeted time during a scheduling unit
Requirement:
![Page 5: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/5.jpg)
DEOS ArchitectureDEOS Architecture
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
DEOS Kernel
...if(...) assert(false);...
class Thread
class StartofPeriodEvent
class ListofThreads
class Scheduler
![Page 6: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/6.jpg)
Verification of DEOSVerification of DEOS
We used Bandera and Java PathFinder (JPF) Verification of the system exhausted 4
Gigabytes of memory without completing– no information about satisfaction of requirement
To verify property or produce a counter-example– state space must be reduced– some form of abstraction is needed
![Page 7: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/7.jpg)
Data Type AbstractionData Type Abstraction
int x = 0;if (x == 0) x = x + 1;
Data domains
(n<0) : NEG(n==0): ZERO(n>0) : POS
Signs
NEG POSZERO
int
Code
Signs x = ZERO;if (Signs.eq(x,ZERO)) x = Signs.add(x,POS);
Collapses data domains via abstract interpretation:
![Page 8: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/8.jpg)
Variable SelectionVariable Selection
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
Control dependencies:
29 conditionals
16 methods
32 variables
DEOS Kernel
int itsPeriodId = 0; ...public int currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=itsPeriodId + 1; ... }
class StartofPeriodEvent
int itsLastExecution; ...public void startChargingCPUTime(){ int cp=itsEvent.currentPeriod(); if(cp == itsLastExecution) { ... }
class Thread
...if(...) assert(false);...
![Page 9: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/9.jpg)
Variable SelectionVariable Selection
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
Control dependencies:
29 conditionals
16 methods
32 variables
DEOS Kernel
int itsPeriodId = 0; ...public int currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=itsPeriodId + 1; ... }
class StartofPeriodEvent
int itsLastExecution; ...public void startChargingCPUTime(){ int cp=itsEvent.currentPeriod(); if(cp == itsLastExecution) { ... }
class Thread
...if(...) assert(false);...
![Page 10: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/10.jpg)
Unbounded!
Variable SelectionVariable Selection
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
DEOS Kernel
int itsPeriodId = 0; ...public int currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=itsPeriodId + 1; ... }
class StartofPeriodEvent
int itsLastExecution; ...public void startChargingCPUTime(){ int cp=itsEvent.currentPeriod(); if(cp == itsLastExecution) { ... }
class Thread
...if(...) assert(false);...
Data dependencies
![Page 11: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/11.jpg)
Attaching Abstract TypesAttaching Abstract Types
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
DEOS Kernel
int itsPeriodId = 0; ...public int currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=itsPeriodId + 1; ... }
class StartofPeriodEvent
int itsLastExecution; ...public void startChargingCPUTime(){ int cp=itsEvent.currentPeriod(); if(cp == itsLastExecution) { ... }
class Thread
...if(...) assert(false);...
SIGNS
SIGNS
SIGNS
![Page 12: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/12.jpg)
Code TransformationCode Transformation
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
DEOS Kernel
Signs itsPeriodId = ZERO; ...public Signs currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=Signs.add(itsPeriodId ,POS);... }
class StartofPeriodEvent
Signs itsLastExecution; ...public void startChargingCPUTime(){ Signs cp=itsEvent.currentPeriod(); if(Signs.eq(cp,itsLastExecution)){ ... }
class Thread
...if(...) assert(false);...
![Page 13: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/13.jpg)
Verification of Abstracted DEOS Verification of Abstracted DEOS
JPF completed the check– produced a 464 step counter-example
Does the counter-example correspond to a feasible execution?– difficult to determine– because of abstraction, we may get spurious errors
We re-ran JPF to perform a customized search– found a guaranteed feasible 318 step counter-example
![Page 14: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/14.jpg)
Our hypothesis Our hypothesis
Abstraction of data domains is necessaryAutomated support for
– Defining abstract domains (and operators)– Selecting abstractions for program components– Generating abstract program models– Interpreting abstract counter-examples
will make it possible to– Scale property verification to realistic systems– Ensure the safety of the verification process
![Page 15: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/15.jpg)
Abstraction in BanderaAbstraction in Bandera
AbstractionLibrary
BASLCompiler
VariableConcrete Type
Abstract Type
Inferred Type
Object
xydonecount
ob
intintbool
Buffer
int….
SignsSignsSigns
intbool
….PointBuffer
Program Abstract CodeGenerator
AbstractedProgram
BanderaAbstractionSpecificationLanguage
AbstractionDefinition
PVS
![Page 16: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/16.jpg)
Definition of Abstractions in BASLDefinition of Abstractions in BASLabstraction Signs abstracts intbegin TOKENS = { NEG, ZERO, POS };
abstract(n) begin n < 0 -> {NEG}; n == 0 -> {ZERO}; n > 0 -> {POS}; end
operator + add begin (NEG , NEG) -> {NEG} ; (NEG , ZERO) -> {NEG} ; (ZERO, NEG) -> {NEG} ; (ZERO, ZERO) -> {ZERO} ; (ZERO, POS) -> {POS} ; (POS , ZERO) -> {POS} ; (POS , POS) -> {POS} ; (_,_) -> {NEG,ZERO,POS}; /* case (POS,NEG),(NEG,POS) */ end
AutomaticGeneration
Forall n1,n2: neg?(n1) and neg?(n2) implies not pos?(n1+n2)
Forall n1,n2: neg?(n1) and neg?(n2) implies not zero?(n1+n2)
Forall n1,n2: neg?(n1) and neg?(n2) implies not neg?(n1+n2)
Proof obligations submitted to PVS...
Example: Start safe, then refine: +(NEG,NEG)={NEG,ZERO,POS}
![Page 17: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/17.jpg)
Compiling BASL DefinitionsCompiling BASL Definitionsabstraction Signs abstracts intbegin TOKENS = { NEG, ZERO, POS };
abstract(n) begin n < 0 -> {NEG}; n == 0 -> {ZERO}; n > 0 -> {POS}; end
operator + add begin (NEG , NEG) -> {NEG} ; (NEG , ZERO) -> {NEG} ; (ZERO, NEG) -> {NEG} ; (ZERO, ZERO) -> {ZERO} ; (ZERO, POS) -> {POS} ; (POS , ZERO) -> {POS} ; (POS , POS) -> {POS} ; (_,_)-> {NEG, ZERO, POS}; /* case (POS,NEG), (NEG,POS) */ end
public class Signs { public static final int NEG = 0; // mask 1 public static final int ZERO = 1; // mask 2 public static final int POS = 2; // mask 4 public static int abs(int n) { if (n < 0) return NEG; if (n == 0) return ZERO; if (n > 0) return POS; }
public static int add(int arg1, int arg2) { if (arg1==NEG && arg2==NEG) return NEG; if (arg1==NEG && arg2==ZERO) return NEG; if (arg1==ZERO && arg2==NEG) return NEG; if (arg1==ZERO && arg2==ZERO) return ZERO; if (arg1==ZERO && arg2==POS) return POS; if (arg1==POS && arg2==ZERO) return POS; if (arg1==POS && arg2==POS) return POS; return Bandera.choose(7); /* case (POS,NEG), (NEG,POS) */ }
Compiled
![Page 18: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/18.jpg)
Data Type AbstractionsData Type Abstractions Library of abstractions for base types
contains:– Range(i,j), i..j modeled precisely, e.g., Range(0,0) is
the signs abstraction
– Modulo(k), Set(v,…)
– Point maps all concrete values to unknown
– User extendable for base types Array abstractions: index & element abstractions
Class abstractions: abstract each field
![Page 19: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/19.jpg)
Interpreting ResultsInterpreting Results
Example:x = -2; if(x + 2 == 0) then ...x = NEG; if(Signs.eq(Signs.add(x,POS),ZERO))
then ... {NEG,ZERO,POS}
For an abstracted program, a counter-example may be infeasible because:– Over-approximation introduced by abstraction
![Page 20: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/20.jpg)
Choose-free state space searchChoose-free state space search
Theorem [Saidi:SAS’00] Every path in the abstracted program where all
assignments are deterministic is a path in the concrete program.
Bias the model checker– to look only at paths that do not include
instructions that introduce non-determinism JPF model checker modified
– to detect non-deterministic choice (i.e. calls to Bandera.choose()); backtrack from those points
![Page 21: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/21.jpg)
Choice-bounded SearchChoice-bounded Search
choose()
X X
Detectable ViolationUndetectable Violation State space searched
![Page 22: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/22.jpg)
Comparison to Related Work Comparison to Related Work Predicate abstraction (Graf/Saidi)
– We use PVS to abstract operator definitions, not complete systems
– We can reuse abstractions for different systems Tool support for program abstraction
– e.g., SLAM, JPF, Feaver Abstraction at the source-code level
– Supports multiple checking tools – e.g., JPF, Java Checker/Verisoft, FLAVERS/Java, …
Counter-example analysis – Theorem prover based (InVest)– Forward simulation (Clarke et. al.)
![Page 23: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/23.jpg)
StatusStatus
Bandera supports abstraction – Library of base type abstractions– Tool-support for user-defined abstraction– Array abstractions– Finding feasible counter-examples
Surprisingly effective on realistic code– 1000s of lines, 10s of threads– Non-trivial data that influences control
![Page 24: Tool-supported Program Abstraction for Finite-state Verification Matthew Dwyer 1, John Hatcliff 1, Corina Pasareanu 1, Robby 1, Roby Joehanes 1, Shawn](https://reader036.vdocument.in/reader036/viewer/2022062504/5a4d1b727f8b9ab0599b5c4a/html5/thumbnails/24.jpg)
Ongoing WorkOngoing Work
Extending abstractions– Heap abstractions– Symbolic abstractions
Automated support for selection– Counter-example driven refinement
Environments and abstraction Discrete-time abstractions
– Exploit scheduling information from RT Java