Temporal Verification of Programs
Total Page:16
File Type:pdf, Size:1020Kb
Temporal verification of programs Eric Koskinen University of Cambridge Computer Laboratory Jesus College November 2012 This dissertation is submitted for the degree of Doctor of Philosophy Declaration This dissertation is the result of my own work and includes nothing which is the outcome of work done in collaboration except where specifically indicated in the text. This dissertation does not exceed the regulation length of 60000 words, including tables and footnotes. Summary Temporal verification of programs Eric Koskinen Modern software systems are ubiquitous and complex, often running on critical platforms ranging from human implant devices to nuclear power plant controls. How can we be sure that these programs will behave as intended? Programmers must first specify the correct behavior of their programs, and one widely accepted specification language is temporal logic. Despite decades of research in finite-state contexts and some adaptations of finite-state algorithms, we still lack scalable tools for proving temporal logic properties of software. This dissertation presents scalable techniques for verifying temporal logic properties of transition systems that are described as programs. We exploit the structure of the property and program in such a way that modern abstraction techniques (interpolation, abstraction refinement, termi- nation argument refinement, etc.) can be applied. We distill temporal property verification into the search for a solution to a safety problem, in tandem with the search for sufficient liveness (termination) arguments. This structure allows us to reduce temporal verification to a program analysis task: we generate an encoding such that when modern analysis tools are applied, they are performing the reasoning necessary for temporal verification. The reduction pertains to verification of state-based temporal logics and, in particular, the uni- versal fragment of Computation Tree Logic (∀CTL). However, in industry, trace-based properties (e.g. LTL, ITL, PSL, SVA) are commonly used and tend to be a natural specification language. Nevertheless, we overcome the divide, showing how our state-based techniques can be used to prove trace-based (i.e. LTL) properties of programs. We observe that LTL can be approxi- mated by CTL. We then introduce a method that examines the ∀CTL counterexamples and, if they are not valid LTL counterexamples, symbolically characterizes problematic nondeterminism with decision predicates. We then symbolically determinize the input program with respect to the decision predicates, introducing prophecy variables to predict the future outcome of these nondeterministic choices. Consequently, we are able to prove LTL properties with an ∀CTL verifier where we previously could not. Together, these techniques enable us to prove useful temporal logic properties of imperative programs (e.g. written in the C programming language). We demonstrate—using code fragments from the PostgreSQL database server, Apache web server, and Windows OS kernel—that our method can yield enormous performance improvements in comparison to known tools, allowing us to automatically prove properties of programs where we could not prove them before. 3 For August. Acknowledgments I have been fortunate to have studied among a community of talented and devoted re- searchers. A proper enumeration of acknowledgment is difficult, so I shall mention only those from whom I have had particularly close support. I am grateful to my official supervisor Michael Gordon who provided feedback on my dissertation and endless logistical support. While at the Computer Laboratory, I was for- tunate to have worked closely with Matthew Parkinson and Peter Sewell, who provided ongoing support while I was developing mathematical fluency. My officemates Matko Botinčan, Mike Dodds, and John Wickerson were also often the source of valuable dis- cussions. I would also like to thank Peter Sewell and Andrey Rybalchenko for their close examination of this dissertation. Several people outside the Computer Laboratory de- serve special mention. First, I would like to thank Maurice Herlihy for drawing me into academia in the early stages of my career. I value my time spent with him and hope for lifelong collaboration. Second, I thank Tim Harris, Peter O’Hearn and Hongseok Yang for their encouragement as I came to Cambridge. On several occasions Josh Berdine and Nir Piterman helped ensure the mathematical integrity of my work. Finally, it was a pleasure to collaborate with Moshe Vardi. Most significantly, I owe a debt of gratitude to my primary supervisor, Byron Cook. I began at Cambridge with only a minimal understanding of formal methods. He drew me deeper and deeper into theory, until I had developed mathematical fluency. Byron’s support went beyond what should be expected of a supervisor. His patience with me and belief that I could succeed have been particularly noteworthy. I am pleased to have him as both a close friend and collaborator. I would like to thank the Gates Cambridge Scholarship program and the Computer Lab- oratory (esp. Lise Gough). I would also like to acknowledge support from countless friends and family members, especially my parents and Charmaine Jelbert. 5 Contents Nomenclature 9 1 Introduction 11 1.1 Dissertation .................................... 11 1.2 Results......................................... 14 1.3 Contributions and organization . ...... 17 2 Foundations of temporal verification 21 2.1 Transitionsystems ............................... 21 2.2 Automatic software verification . ...... 25 2.3 Temporallogic ................................... 27 2.3.1 LinearTemporalLogic ........................... 28 2.3.2 Existing LTL verification techniques . ..... 29 2.3.3 ComputationTreeLogic . 30 2.3.4 Over approximating LTL traces with ∀CTLtrees ........... 32 3 Proof system for ∀CTL 35 3.1 Example........................................ 35 3.2 Proofsystem ..................................... 36 3.3 Frontiers....................................... 38 3.4 Remainingproofrules.............................. 40 3.5 Examplerevisited ................................ 43 4 Safety and liveness 44 4.1 Preliminaries ................................... 45 4.2 Encoding........................................ 47 4.3 Thetransitionpredicate. ..... 48 4.4 Example........................................ 54 4.5 Correctnessoftheencoding . 55 4.6 Relatedwork ..................................... 55 5 Symbolic determinization for LTL 58 5.1 Example........................................ 59 5.2 Characterizing nondeterministic choice . .......... 60 5.3 Symbolic partial determinization . ....... 61 5.4 Traceequivalence................................ 65 5.5 Proving LTL with ∀CTLanddeterminization . 67 5.6 Relatedwork ..................................... 69 6 Linear arithmetic programs 70 6.1 Simple Programming Language . 71 6.2 SPL verification as a program analysis task . ....... 73 6.2.1 Specialization of Chapter 4 . 73 6.2.2 Encoding for program analysis tools . 75 6.2.3 Finite representation of transition relation . ......... 75 6.3 Example........................................ 77 6.4 Rankfunctionsynthesis............................ 79 7 Determinization refinement 82 7.1 Iteratedalgorithm ............................... 82 7.2 Decisionpredicaterefinement . ..... 84 7.2.1 Correctness criteria for Refine ...................... 84 7.2.2 Implementation ............................... 84 7.2.3 Example.................................... 86 7.2.4 Progress.................................... 87 7.3 Decisionpredicatesynthesis . ...... 88 7.4 Examples ....................................... 89 7 8 Evaluation 93 8.1 Implementation and optimizations . ...... 93 8.2 Benchmarks...................................... 97 8.3 Experiments..................................... 98 9 Conclusion 101 9.1 Summary ....................................... 101 9.2 Nextsteps....................................... 102 A Proofs of (de)composability 112 B Correctness of the encoding 114 B.1 Lemmas ........................................ 114 B.2 Soundness ....................................... 115 B.3 Relativecompleteness ............................. 118 C Operational semantics with a program counter 120 D Coq proof script 121 D.1 Library boolean .................................... 121 D.2 Library base ...................................... 122 D.3 Library traces ..................................... 123 D.4 Library wf ....................................... 124 D.5 Library actl ...................................... 124 D.6 Library cktl ...................................... 125 D.7 Library mach ..................................... 140 D.8 Library mctl ...................................... 140 D.9 Library ltl ....................................... 141 D.10 Library dpred ..................................... 143 8 Nomenclature α An atomic proposition, page 28 χ Counterexample, page 79 ≅ Simulation relation, page 64 ǫ Subformula path constructor, page 32 η Translation from LTL to CTL, page 32 Γ Counterexample Flowgraph, page 85 IΩ Initial state of determinized transition system, page 62 κ Subformula path expression, page 32 Ð→ Operational semantics of SPL, page 72 N The natural numbers, page 22 Vars The set of all variables (SPL), page 10 R Program counter constructor, page 120 S Program counter constructor, page 120 M Ω Symbolically determinized transition system, page 61 ⊭C CTL non-entailment, page 33 Π Set of all state streams, page 24 π Infinite sequence (i.e. Stream) of states, page 23