1 Proving program termination Lecture 5 February 4 th, 2008 TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A 2 Notes No new homework for now Remember: no class next week 3 Review Proving termination of mathematical relations Program termination = WF transition relation Subrelations of WF-relations are WF-relations Proving WF can be reduced to finding a larger ranking relation Accurate transition relations often too hard to compute Supporting invariants needed to establish termination Unions of WF-relations not WF, but transitive closure can be used to offset the problem Local termination lemmas useful when proving structured relations WF 4 Review Synthesis for mathematical relations Linear ranking functions ranging over simple types (i.e. not the ordinals) can be reliably synthesized for certain classes of relations Synthesis is possible for more complex settings, but not very reliable 5 Review But what about programs? 6 Review But what about programs? Complex control-flow graphs (e.g., gotos, nested loops, etc) Procedures and recursion Arrays and pointers Dynamically allocated (and deallocated) memory Concurrency 7 Review But what about programs? Complex control-flow graphs (e.g., gotos, nested loops, etc) Procedures and recursion Arrays and pointers Dynamically allocated (and deallocated) memory Concurrency 8 Today Today: Programs and existing tools for proving invariance/safety 9 Today Today: Programs and existing tools for proving invariance/safety 10 Programs 11 Programs 12 Programs 13 Programs 14 Programs 15 Programs 16 Programs 17 Programs 18 Programs 19 Programs 20 Programs 21 Programs 22 Programs 23 Programs 24 Programs 25 Programs 26 Programs 27 Programs 28 Programs 29 Programs 30 Programs 31 Programs 32 Programs 33 Verification and analysis tools for invariance Great progress has been made in the last 5 years in tools for proving invariance properties of programs Automatic invariance analysis Not property driven Facts derived from a given abstract domain Termination (of the tool) usually guaranteed Automatic invariance verification Usually property driven Termination (of the tool) not guaranteed Today: a very operational summary of some example tools 34 Verification and analysis tools for invariance Great progress has been made in the last 5 years in tools for proving invariance properties of programs Automatic invariance analysis Not property driven Facts derived from a given abstract domain Termination (of the tool) usually guaranteed Automatic invariance verification Usually property driven Termination (of the tool) not guaranteed Today: a very operational summary of some example tools 35 Invariance analysis 36 Invariance analysis 37 Invariance analysis 38 Invariance analysis 39 Invariance analysis 40 Invariance analysis 41 Invariance analysis 42 Invariance analysis 43 Invariance analysis 44 Invariance analysis 45 Invariance analysis 46 Invariance analysis 47 Invariance analysis 48 Invariance analysis 49 Invariance analysis 50 Invariance analysis 51 Abstract domains Provide standard operations Assign, assume, Emptiness check Abstract version of union, intersect Widening, narrowing Popular domain: Octagon represents convex sets expressed as conjunction of two variable inequalities with unit co-effecients Implementation based on difference bound matrices 52 Abstract domains Provide standard operations Assign, assume, Emptiness check Abstract version of union, intersect Widening, narrowing Popular domain: Octagon represents convex sets expressed as conjunction of two variable inequalities with unit co-effecients Implementation based on difference bound matrices 53 Abstract domains Provide standard operations Assign, assume, Emptiness check Abstract version of union, intersect Widening, narrowing Popular domain: Octagon represents convex sets expressed as conjunction of two variable inequalities with unit co-effecients Implementation based on difference bound matrices 54 Abstract domains Provide standard operations Assign, assume, Emptiness check Abstract version of union, intersect Widening, narrowing Popular domain: Octagon represents convex sets expressed as conjunction of two variable inequalities with unit co-effecients Implementation based on difference bound matrices 55 Abstract domains Provide standard operations Assign, assume, Emptiness check Abstract version of union, intersect Widening, narrowing Popular domain: Octagon represents convex sets expressed as conjunction of two variable inequalities with unit co-effecients Implementation based on difference bound matrices 56 Abstract domains Provide standard operations Assign, assume, Emptiness check Abstract version of union, intersect Widening, narrowing Popular domain: Octagon represents convex sets expressed as conjunction of two variable inequalities with unit co-effecients Implementation based on difference bound matrices 57 Verification and analysis tools for invariance Great progress has been made in the last 5 years in tools for proving invariance properties of programs Automatic invariance analysis Not property driven Facts derived from a given abstract domain Termination (of the tool) usually guaranteed Automatic invariance verification Usually property driven Termination (of the tool) not guaranteed Today: a very operational summary of some example tools 58 Verification and analysis tools for invariance Great progress has been made in the last 5 years in tools for proving invariance properties of programs Automatic invariance analysis Not property driven Facts derived from a given abstract domain Termination (of the tool) usually guaranteed Automatic invariance verification Usually property driven Termination (of the tool) not guaranteed Today: a very operational summary of some example tools 59 Invariance verification for invariance 60 Invariance verification for invariance 61 Symbolic execution based on decision procedure SLAM Driver passes rule Rule violation found Rule Example: SLAM Refine Step Abstract Step Check Step Instrumen t Step Construction of abstract programs w/ WPs for commands and a decision procedure Reachability for abstract programs Code 62 Example: SLAM 63 Example: SLAM 64 Example: SLAM 65 Example: SLAM 66 Example: SLAM 67 Example: SLAM 68 Example: SLAM 69 Example: SLAM 70 Example: SLAM 71 Example: SLAM 72 Example: SLAM 73 Example: SLAM 74 Example: SLAM 75 Example: SLAM 76 Example: SLAM 77 Example: SLAM 78 Example: SLAM 79 Example: SLAM 80 Example: SLAM 81 Example: SLAM 82 Example: SLAM 83 Example: SLAM 84 Example: SLAM 85 Example: SLAM 86 Example: SLAM 87 Example: SLAM 88 Example: SLAM 89 Verification and analysis tools for invariance Great progress has been made in the last 5 years in tools for proving invariance properties of programs Automatic invariance analysis Not property driven Facts derived from a given abstract domain Termination (of the tool) usually guaranteed Automatic invariance verification Usually property driven Termination (of the tool) not guaranteed Today: a very operational summary of some example tools 90 Verification and analysis tools for invariance Great progress has been made in the last 5 years in tools for proving invariance properties of programs Automatic invariance analysis Not property driven Facts derived from a given abstract domain Termination (of the tool) usually guaranteed Automatic invariance verification Usually property driven Termination (of the tool) not guaranteed Today: a very operational summary of some example tools