Upload
gloriann-stevens
View
33
Download
2
Embed Size (px)
DESCRIPTION
Proving Mutual Termination of single-threaded programs. Dima Elenbogen Ofer Strichman Shmuel Katz Technion, Haifa, Israel. Notion of equivalence for this presentation. Goal: verification of the mutual termination of two similar programs . Mutual termination Given equal inputs, - PowerPoint PPT Presentation
Citation preview
Proving Mutual Terminationof single-threaded programs
Dima Elenbogen Ofer Strichman Shmuel Katz
Technion, Haifa, Israel
08:56:27 PM
4
Notion of equivalence for this presentation
Goal: verification of the mutual termination of two similar programs.
Mutual termination
Given equal inputs, P1 terminates , P2 terminates
Undecidable
08:56:27 PM
5
Alternative: termination of a single program New tools have recently been developed:
Terminator Mutant …
Still, there are two major problems: Incompleteness Complexity
08:56:27 PM
6
Mutual Termination vs. Proving Termination
Pros: Computationally easier to check the mutual terminations of two
programs than to prove the termination of each of them. Fully automated.
It does not require finding a well-founded set. Program do not necessarily terminate.
Termination check has nothing to say Mutual termination can still say something useful.
Cons: Defines a weaker notion.
08:56:27 PM
7
Goals
Develop proof rules for mutual termination
Present an algorithm for checking mutual termination, that uses the proof rules, and is sensitive to the magnitude of change rather than the magnitude
of the programs
08:56:27 PM
8
Prerequisites
Assume: no loops (but there are recursive functions); 1-1 mapping map between the functions of both sides:
must intersect all cycles in the call graphs; the mapped functions have the same signature
A:f1()
f2()f5()
f3() f4()f6()
f1’()
f2’()
f4’()
f5’()
f7’()
B:
08:56:27 PM
2 map
2 map
2 map
2 map
9
Mutual termination (simple case)
Consider the call graphs:
We want to prove that A, B are mutually terminating How shall we handle the recursion ?
A B
Side 1 Side 2
08:56:27 PM
10
Call-equivalence
Definition: functions A,B are call-equivalent if… For equal inputs:
For callees f,g s.t. (f,g) 2 map: f is called , g is called f and g are called with the same arguments.
B(x, y) {
g(0,0)
if (cond2)
g(x,y)
if (cond3)
g(x,y)
}
A(x, y) {
if (cond1)
f(x,y)
f(0, 0)
}
08:56:27 PM
The order and the number of calls do not matter
11
Preliminary inference rule (simple case)
A(x, y) {
…
if (cond1)
A(x1,y1)
else …
…
}
B(w, z) {
…
if (cond2)
B(w1,z1)
else …
..
}
A
Side 1
B
Side 2
call-equiv(A, B)mutual-terminate(A, B)
(M-TERM-REC)
08:56:28 PM
12
The premise is undecidable
A(x, y) {
…
if (A(x’, y’) > …)
A(x1,y1)
else …
…
}
B(w, z) {
…
if (B(w’, z’) > …)
B(w1,z1)
else …
..
}
A
Side 1
B
Side 2
How can we prove the premise?
call-equiv(A, B)mutual-terminate(A, B)
(M-TERM-REC)
08:56:28 PM
13
Uninterpreted functions
Replace the recursive calls with calls to functions that over-approximate A, B, and are terminating by construction
Natural candidates: Uninterpreted Functions Abstract all functionality. We only know they are consistent: x = y → UF(x) = UF(y)
call-equiv(A, B)mutual-terminate(A, B)
(M-TERM-REC)
08:56:28 PM
F(x, y) {
…
if (cond1)
F(x1,y1)
else …
…
}
G(w, z) {
…
if (cond2)
G(w1,z1)
else …
..
}
14
Replacing recursive calls (1 / 2)
Let FUF , GUF be F,G, after replacing the recursive call with a call to the corresponding uninterpreted functions.
F
Side 1
G
Side 2
08:56:28 PM
Let FUF , GUF be F,G, after replacing the recursive call with a call to the corresponding uninterpreted functions.
GUF(w, z) {
…
if (cond2)
UF(G)(w1,z1)
else …
..
}
FUF(x, y) {
…
if (cond1)
UF(F)(x1,y1)
else …
…
}
15
Replacing recursive calls (2 / 2)
FUF
Side 1
GUF
Side 2UF(F) UF(G)
08:56:28 PM
16
Proving mutual termination
Let FUF , GUF be F,G, after replacing the recursive calls with calls to uninterpreted functions.
We can now rewrite the rule:
This premise is decidable
call-equiv(FUF, GUF)mutual-terminate(F, G) (M-TERM-SIMPLE)
08:56:28 PM
17
General inference rule
Now we want to generalize from a single self loop to MSCCs in the call graphs:
Definition: is called in A]
∀(F, G) ∈ map. call-equiv(FUF, GUF)∀(F, G) ∈ map. mutual-terminate(F, G) (M-TERM)
08:56:28 PM
18
Connected MSCCs
Connected MSCCs… Prove bottom-up Abstract mutually terminating functions Inline
Side 1 Side 2
g g’
h h’UF(h) UF(h’)
{(g,g’),(f,f’),(h,h’)} 2 map
08:56:28 PM
U
19
Decomposition algorithm
A: B:
f1()
f2()f5()
f3() f4() f6()
f1’()
f2’()
f4’()
f5’()
Mutually terminating pair
Syntactically equivalent pair
Mutual termination undecided yetCould not prove mutual termination
Legend:
check
check Unpaired function
f7’()U U
U
08:56:28 PM
check
20
Mutual recursion
Find a sub-map that intersects all cycles, e.g., {(g,g’)} Only when calling functions in this sub-map, replace with
uninterpreted functions
Side 1 Side 2
f ’
UF(g’)
g g’f
UF(g) {(g,g’),(f,f’)} 2 map
08:56:28 PM
UU
21
Decomposition with mutual recursion
A: B:
f1()
f2() f5()U
Call-equivalent; mutual termination undecided yet
check
08:56:28 PM
UUU UU
f1’()
f2’() f5’()U UUU
Mutually terminating pair
Syntactically equivalent pair
Mutual termination undecided yetCould not prove mutual termination
Legend:
22
The Regression Verification Tool (RVT)
Given two C programs: loops recursive functions.
Map functions, globals, etc.
After that: Decompose to the granularity of pairs of functions Use a C verification engine (CBMC)
08:56:28 PM
23
RVT
Version A Version B
CBMC
enforce equality of inputs
replace with UFsassert call-equivalence
feedback
call-equivalence counterexample
C program
RVT
Merge Rename identical
globals Map
functions/globals Decompose static analyses
08:56:28 PM
24
Improvements of completeness (1 / 2)
Partial equivalence
Terminating executions of P1 and P2 on equal inputs result in equal outputs.
Taking advantage of the partial equivalence of functions:
If we know that (f, g) ∈ map are partially equivalent, then UF(f) = UF(g)
We welcome additional ideas how to refine our UFs.
08:56:28 PM
25
Improvements of completeness (2 / 2)
Ignoring input arguments that do not affect the call-equivalence of a function: This improves mapping, as some mapped function pairs may
have different prototypes.
08:56:28 PM
Suppose we know that function A terminates. Can it help us to prove the termination of A’?
Define call-contain(A, A’) as: For equal inputs :
For each pair (f, f ’) 2 map:
f ‘ is called in A’ with argument x f is called in A with argument x
26
Checking the termination of functions
08:56:28 PM
∀(F, F’) ∈ map. (term(F) ∧ call-contain(FUF ,F’UF))∀(F, F’) ∈ map. term(F’)
(TERM)
28
Value of Mutual Termination
Full equivalence P1 and P2 are partially equivalent and mutually terminate.
Introduced in:• Luckham, Park, and M. Paterson 1970
[On formalized computer programs] • Pratt 1971 [Kernel equivalence of programs and proving kernel equivalence and
correctness by test cases]
Regression verification of full equivalence is an important problem.
Proving mutual termination is a crucial sub-task.
08:56:28 PM
30
unsigned gcd1UF
(unsigned a, unsigned b) { unsigned g; if (b == 0) g = a; else { a = a % b; g = gcd1(b, a); } return g; }
unsigned gcd2UF
(unsigned x, unsigned y) { unsigned z; z = x; if (y > 0) z = gcd2(y, z % y); } return z; }
Using (M-TERM-SIMPLE): example (1/2)
=UF1
UF2
a, b) x, y)
term
08:56:28 PM
?