485 research outputs found
Convex polyhedral abstractions, specialisation and property-based predicate splitting in Horn clause verification
We present an approach to constrained Horn clause (CHC) verification
combining three techniques: abstract interpretation over a domain of convex
polyhedra, specialisation of the constraints in CHCs using abstract
interpretation of query-answer transformed clauses, and refinement by splitting
predicates. The purpose of the work is to investigate how analysis and
transformation tools developed for constraint logic programs (CLP) can be
applied to the Horn clause verification problem. Abstract interpretation over
convex polyhedra is capable of deriving sophisticated invariants and when used
in conjunction with specialisation for propagating constraints it can
frequently solve challenging verification problems. This is a contribution in
itself, but refinement is needed when it fails, and the question of how to
refine convex polyhedral analyses has not been studied much. We present a
refinement technique based on interpolants derived from a counterexample trace;
these are used to drive a property-based specialisation that splits predicates,
leading in turn to more precise convex polyhedral analyses. The process of
specialisation, analysis and splitting can be repeated, in a manner similar to
the CEGAR and iterative specialisation approaches.Comment: In Proceedings HCVS 2014, arXiv:1412.082
An iterative approach to precondition inference using constrained Horn clauses
We present a method for automatic inference of conditions on the initial
states of a program that guarantee that the safety assertions in the program
are not violated. Constrained Horn clauses (CHCs) are used to model the program
and assertions in a uniform way, and we use standard abstract interpretations
to derive an over-approximation of the set of unsafe initial states. The
precondition then is the constraint corresponding to the complement of that
set, under-approximating the set of safe initial states. This idea of
complementation is not new, but previous attempts to exploit it have suffered
from the loss of precision. Here we develop an iterative specialisation
algorithm to give more precise, and in some cases optimal safety conditions.
The algorithm combines existing transformations, namely constraint
specialisation, partial evaluation and a trace elimination transformation. The
last two of these transformations perform polyvariant specialisation, leading
to disjunctive constraints which improve precision. The algorithm is
implemented and tested on a benchmark suite of programs from the literature in
precondition inference and software verification competitions.Comment: Paper presented at the 34nd International Conference on Logic
Programming (ICLP 2018), Oxford, UK, July 14 to July 17, 2018 18 pages, LaTe
Enhancing Predicate Pairing with Abstraction for Relational Verification
Relational verification is a technique that aims at proving properties that
relate two different program fragments, or two different program runs. It has
been shown that constrained Horn clauses (CHCs) can effectively be used for
relational verification by applying a CHC transformation, called predicate
pairing, which allows the CHC solver to infer relations among arguments of
different predicates. In this paper we study how the effects of the predicate
pairing transformation can be enhanced by using various abstract domains based
on linear arithmetic (i.e., the domain of convex polyhedra and some of its
subdomains) during the transformation. After presenting an algorithm for
predicate pairing with abstraction, we report on the experiments we have
performed on over a hundred relational verification problems by using various
abstract domains. The experiments have been performed by using the VeriMAP
transformation and verification system, together with the Parma Polyhedra
Library (PPL) and the Z3 solver for CHCs.Comment: Pre-proceedings paper presented at the 27th International Symposium
on Logic-Based Program Synthesis and Transformation (LOPSTR 2017), Namur,
Belgium, 10-12 October 2017 (arXiv:1708.07854
Analysis and Transformation Tools for Constrained Horn Clause Verification
Several techniques and tools have been developed for verification of
properties expressed as Horn clauses with constraints over a background theory
(CHC). Current CHC verification tools implement intricate algorithms and are
often limited to certain subclasses of CHC problems. Our aim in this work is to
investigate the use of a combination of off-the-shelf techniques from the
literature in analysis and transformation of Constraint Logic Programs (CLPs)
to solve challenging CHC verification problems. We find that many problems can
be solved using a combination of tools based on well-known techniques from
abstract interpretation, semantics-preserving transformations, program
specialisation and query-answer transformations. This gives insights into the
design of automatic, more general CHC verification tools based on a library of
components.Comment: To appear in Theory and Practice of Logic Programming (TPLP
Proving Correctness of Imperative Programs by Linearizing Constrained Horn Clauses
We present a method for verifying the correctness of imperative programs
which is based on the automated transformation of their specifications. Given a
program prog, we consider a partial correctness specification of the form
prog , where the assertions and are
predicates defined by a set Spec of possibly recursive Horn clauses with linear
arithmetic (LA) constraints in their premise (also called constrained Horn
clauses). The verification method consists in constructing a set PC of
constrained Horn clauses whose satisfiability implies that prog
is valid. We highlight some limitations of state-of-the-art
constrained Horn clause solving methods, here called LA-solving methods, which
prove the satisfiability of the clauses by looking for linear arithmetic
interpretations of the predicates. In particular, we prove that there exist
some specifications that cannot be proved valid by any of those LA-solving
methods. These specifications require the proof of satisfiability of a set PC
of constrained Horn clauses that contain nonlinear clauses (that is, clauses
with more than one atom in their premise). Then, we present a transformation,
called linearization, that converts PC into a set of linear clauses (that is,
clauses with at most one atom in their premise). We show that several
specifications that could not be proved valid by LA-solving methods, can be
proved valid after linearization. We also present a strategy for performing
linearization in an automatic way and we report on some experimental results
obtained by using a preliminary implementation of our method.Comment: To appear in Theory and Practice of Logic Programming (TPLP),
Proceedings of ICLP 201
Precondition Inference via Partitioning of Initial States
Precondition inference is a non-trivial task with several applications in
program analysis and verification. We present a novel iterative method for
automatically deriving sufficient preconditions for safety and unsafety of
programs which introduces a new dimension of modularity. Each iteration
maintains over-approximations of the set of \emph{safe} and \emph{unsafe}
\emph{initial} states. Then we repeatedly use the current abstractions to
partition the program's \emph{initial} states into those known to be safe,
known to be unsafe and unknown, and construct a revised program focusing on
those initial states that are not yet known to be safe or unsafe. An
experimental evaluation of the method on a set of software verification
benchmarks shows that it can solve problems which are not solvable using
previous methods.Comment: 19 pages, 8 figure
- …