Proving program termination and liveness

1
Proving program termination and liveness Byron
Cook Cambridge theory mini-course October 19th,
2007 Lecture II of III
TexPoint fonts used in EMF. Read the TexPoint
manual before you delete this box. A
2
Outline

• Foundations
• Checking termination
• Termination analysis
• Refinement synthesis
• Liveness
• Concurrency

3
Outline

• Foundations
• Checking termination
• Termination analysis
• Refinement synthesis
• Liveness
• Concurrency

4
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

5
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

6
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

7
Questions
8
Questions
9
Questions
10
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

11
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

12
Rank function synthesis

• Question can we automatically synthesize fs if
  we limit their form?
• Linear ranking functions from linear convex
  relations Yes, always!
• Linear ranking functions from linear non-convex
  relations Yes, sometimes..
• Linear ranking functions from non-linear convex
  relations Yes, sometimes..
• ..

13
Rank function synthesis

• Question can we automatically synthesize fs if
  we limit their form?
• Linear ranking functions from linear convex
  relations Yes, always!
• Linear ranking functions from linear non-convex
  relations Yes, sometimes..
• Linear ranking functions from non-linear convex
  relations Yes, sometimes..
• ..

14
Rank function synthesis
15
Rank function synthesis
16
Rank function synthesis
17
Rank function synthesis
18
Rank function synthesis
19
Rank function synthesis
20
Rank function synthesis
21
Rank function synthesis
22
Rank function synthesis
23
Rank function synthesis
24
Rank function synthesis
25
Rank function synthesis
26
Rank function synthesis
27
Rank function synthesis
28
Rank function synthesis
29
Rank function synthesis
30
Rank function synthesis
31
Rank function synthesis
32
Rank function synthesis
33
Rank function synthesis
34
Rank function synthesis
35
Rank function synthesis
36
Rank function synthesis
37
Rank function synthesis
38
Rank function synthesis
39
Rank function synthesis
40
Rank function synthesis
41
Rank function synthesis
42
Rank function synthesis
43
Rank function synthesis
44
Rank function synthesis
45
Rank function synthesis
46
Rank function synthesis
47
Rank function synthesis
48
Rank function synthesis
49
Rank function synthesis
50
Rank function synthesis
51
Rank function synthesis
52
Rank function synthesis
53
Rank function synthesis
54
Rank function synthesis
55
Rank function synthesis
56
Rank function synthesis
57
Rank function synthesis
58
Rank function synthesis
59
Rank function synthesis

• Question can we automatically synthesize fs if
  we limit their form?
• Linear ranking functions from linear convex
  relations Yes, always!
• Linear ranking functions from linear non-convex
  relations Yes, sometimes
• Linear ranking functions from non-linear convex
  relations Yes, sometimes..
• Linear ranking functions with invariants from
  convex relations Yes, always..
• Non-linear ranking functions from non-linear
  convex relations Yes, sometimes..
• ..

60
Rank function synthesis

• Question can we automatically synthesize fs if
  we limit their form?
• Linear ranking functions from linear convex
  relations Yes, always!
• Linear ranking functions from linear non-convex
  relations Yes, sometimes
• Linear ranking functions from non-linear convex
  relations Yes, sometimes..
• Linear ranking functions with invariants from
  convex relations Yes, always..
• Non-linear ranking functions from non-linear
  convex relations Yes, sometimes..
• ..

61
Rank function synthesis
x x 1
assume(xgt0)
assume(xz)
assume(wgt0)
y 33 z
x x 1
x x 1
r r e
x x 1
assume(xgt0)
assume(rtrue)
y y 1
x x 1
w w - x
w 5 w
assume(wgtz)
z -z
x x 1
y 100
assume(k2gt0)
assume(glt100)
assume(tlt0)
assume(ggt0)
w w k
w g g
x x 1
x x 1
z w
p p3
k k / 3
y 3 y
62
Rank function synthesis
x x 1
assume(xgt0)
assume(xz)
assume(wgt0)
y 33 z
x x 1
x x 1
r r e
x x 1
assume(xgt0)
assume(rtrue)
y y 1
x x 1
w w - x
w 5 w
assume(wgtz)
z -z
x x 1
y 100
assume(k2gt0)
assume(glt100)
assume(tlt0)
assume(ggt0)
w w k
w g g
x x 1
x x 1
z w
p p3
k k / 3
y 3 y
63
Rank function synthesis
x x 1
assume(xgt0)
assume(xz)
assume(wgt0)
y 33 z
x x 1
x x 1
r r e
x x 1
assume(xgt0)
assume(rtrue)
y y 1
x x 1
w w - x
w 5 w
assume(wgtz)
z -z
x x 1
y 100
assume(k2gt0)
assume(glt100)
assume(tlt0)
assume(ggt0)
w w k
w g g
x x 1
x x 1
z w
p p3
k k / 3
y 3 y
64
Rank function synthesis
x x 1
assume(xgt0)
assume(xz)
assume(wgt0)
y 33 z
x x 1
x x 1
r r e
x x 1
assume(xgt0)
assume(rtrue)
y y 1
x x 1
w w - x
w 5 w
assume(wgtz)
z -z
x x 1
y 100
assume(k2gt0)
assume(glt100)
assume(tlt0)
assume(ggt0)
w w k
w g g
x x 1
x x 1
z w
p p3
k k / 3
y 3 y
65
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

66
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

67
Termination analysis

• Program analysis vs. automatic program
  verification
• Automatic program verifiers attempt to
  prove/falsify a single given property or die
  trying!
• Examples SLAM, ESC/Java, Boogie, Murf, Zing,
  SPIN, Java Pathfinder, F-Soft, BLAST, etc.
• Program invariance analyses prove what they want
  to prove, but many location-specific lemmas at
  once
• Examples Astree, x86/Codesurfer, Sting, OctAnal,
  SLAyer, TVLA, etc.

68
Termination analysis
69
Termination analysis
70
Termination analysis
71
Termination analysis
72
Termination analysis
73
Termination analysis
74
Termination analysis
75
Termination analysis
76
Termination analysis
77
Termination analysis

• Program analysis vs. automatic program
  verification
• Automatic program verifiers attempt to
  prove/falsify a single given property or die
  trying!
• Examples SLAM, ESC/Java, Boogie, Murf, Zing,
  SPIN, Java Pathfinder, F-Soft, BLAST, etc.
• Program invariance analyses prove what they want
  to prove, but many location-specific lemmas at
  once
• Examples Astree, x86/Codesurfer, Sting, OctAnal,
  SLAyer, TVLA, etc.

78
Termination analysis

• Program analysis vs. automatic program
  verification
• Automatic program verifiers attempt to
  prove/falsify a single given property or die
  trying!
• Examples SLAM, ESC/Java, Boogie, Murf, Zing,
  SPIN, Java Pathfinder, F-Soft, BLAST, etc.
• Program invariance analyses prove what they want
  to prove, but many location-specific lemmas at
  once
• Examples Astree, x86/Codesurfer, Sting, OctAnal,
  SLAyer, TVLA, etc.

79
Termination analysis

• A variance assertion is a transition predicate
  that holds between any state at location n and
  any previous state also at location n
• An isolated variance assertion is a transition
  predicate that holds between any state at
  location n and any previous state also at
  location n such that execution does not leave the
  enclosing loop.
• A variance analysis produces variance assertions
  for each location in a program

80
Variance analyses
81
Variance analyses
82
Variance analyses
83
Variance analyses
84
Variance analyses
85
Variance analyses
86
Variance analyses
87
Variance analyses
88
Variance analyses
89
Variance analyses
90
Variance analyses
91
Variance analyses
92
Variance analyses
93
Variance analyses
94
Variance analyses
95
Variance analyses

• Variance assertions/analyses are a relatively
  modern invention
• POPL07
• CAV06
• State of the art will (I expect) improve
  significantly
• Today
• How to make variance analyses from invariance
  analyses
• Some words on a native variance analysis

96
Variance analyses from invariance analyses
97
Variance analyses from invariance analyses
98
Variance analyses from invariance analyses
99
Variance analyses from invariance analyses
100
Variance analyses from invariance analyses
101
Variance analyses from invariance analyses
102
Variance analyses from invariance analyses
103
Variance analyses from invariance analyses
104
Variance analyses from invariance analyses
105
Variance analyses from invariance analyses
106
Variance analyses from invariance analyses
107
Variance analyses from invariance analyses
108
Proving termination with variance assertions
109
Proving termination with variance assertions
110
Proving termination with variance assertions
111
Proving termination with variance assertions
112
Numerical domains
113
Numerical domains
114
Numerical domains
115
Numerical domains
116
Numerical domains
117
Numerical domains
118
Numerical domains
119
Numerical domains
120
Numerical domains
121
Separation domain
122
Separation domain
123
Separation domain
124
Separation domain
125
Separation domain
126
Separation domain
127
Separation domain
128
Complete example
129
Complete example
130
Complete example
131
Complete example
132
Complete example
133
Complete example
134
Complete example
135
Complete example
136
Complete example
137
Complete example
138
Complete example
139
Complete example
140
Complete example
141
Big problem
142
Complete example
143
Complete example
144
Complete example
145
Complete example
146
Complete example
147
Variance analyses

• Variance assertions/analyses are a relatively
  modern invention
• POPL07
• CAV06
• State of the art will (I expect) improve
  significantly
• Today
• How to make variance analyses from invariance
  analyses
• Some words on native variance analysis

148
Variance analyses
149
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

150
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency

151
Outline

• Foundations
• Checking termination
• Rank function synthesis
• Termination analysis
• Counterexamples refinement
• Liveness
• Concurrency