LTL Software Model Checkingin CPAchecker

Thomas BunkLMU Munich, Germany

October 01, 2019

Thomas Bunk LMU Munich, Germany 1 / 20

LTL Software Model Checking [1]Program P LTL property ϕ

Transition System TS Büchi automaton A¬ϕ

Product automatonTS ⊗ A¬ϕ

Emptiness checkL(TS⊗A¬ϕ) ?= ∅

P � ϕ P 2 ϕτ is CEX

yes no

[1] M. Vardi, P. Wolper: An Automata-Theoretic Approach to Automatic Program Verification [LICS’86]Thomas Bunk LMU Munich, Germany 2 / 20

Büchi Automata in CPAchecker

1. Parsing of LTL properties

I Consider e.g.: [] (x -> F y U X "z > 0")

2. Transformation into Büchi automata using external Tools

3. Parsing and converting the result into automata from theCPAchecker-framework

Thomas Bunk LMU Munich, Germany 3 / 20

Büchi Automata in CPAchecker

1. Parsing of LTL propertiesI Consider e.g.: [] (x -> F y U X "z > 0")

2. Transformation into Büchi automata using external Tools

3. Parsing and converting the result into automata from theCPAchecker-framework

Thomas Bunk LMU Munich, Germany 3 / 20

Büchi Automata in CPAchecker

1. Parsing of LTL propertiesI Consider e.g.: [] (x -> F y U X "z > 0")

2. Transformation into Büchi automata using external Tools

3. Parsing and converting the result into automata from theCPAchecker-framework

Thomas Bunk LMU Munich, Germany 3 / 20

Büchi Automata in CPAchecker

1. Parsing of LTL propertiesI Consider e.g.: [] (x -> F y U X "z > 0")

2. Transformation into Büchi automata using external Tools

3. Parsing and converting the result into automata from theCPAchecker-framework

Thomas Bunk LMU Munich, Germany 3 / 20

Büchi Automata in CPAcheckerLTL properties already used in SV-Comp, e.g.:I Unreachability of Error Function:

CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) )

I Termination:CHECK( init(main()), LTL(F end) )

Keep format for LTL software model checking, i.e.I CHECK ( init(<init_function>) , LTL(<property>) )

Example:I CHECK( init(main()), LTL([]("x>0" ==> <>("y==0"))) )

Execution with CPAchecker:I scripts/cpa.sh -ltl <path/program> -spec <path/specification>

Thomas Bunk LMU Munich, Germany 5 / 20

Büchi Automata in CPAcheckerLTL properties already used in SV-Comp, e.g.:I Unreachability of Error Function:

CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) )

I Termination:CHECK( init(main()), LTL(F end) )

Keep format for LTL software model checking, i.e.I CHECK ( init(<init_function>) , LTL(<property>) )

Example:I CHECK( init(main()), LTL([]("x>0" ==> <>("y==0"))) )

Execution with CPAchecker:I scripts/cpa.sh -ltl <path/program> -spec <path/specification>

Thomas Bunk LMU Munich, Germany 5 / 20

Büchi Automata in CPAcheckerLTL properties already used in SV-Comp, e.g.:I Unreachability of Error Function:

CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) )

I Termination:CHECK( init(main()), LTL(F end) )

Keep format for LTL software model checking, i.e.I CHECK ( init(<init_function>) , LTL(<property>) )

Example:I CHECK( init(main()), LTL([]("x>0" ==> <>("y==0"))) )

Execution with CPAchecker:I scripts/cpa.sh -ltl <path/program> -spec <path/specification>

Thomas Bunk LMU Munich, Germany 5 / 20

Büchi Automata in CPAcheckerLTL properties already used in SV-Comp, e.g.:I Unreachability of Error Function:

CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) )

I Termination:CHECK( init(main()), LTL(F end) )

Keep format for LTL software model checking, i.e.I CHECK ( init(<init_function>) , LTL(<property>) )

Example:I CHECK( init(main()), LTL([]("x>0" ==> <>("y==0"))) )

Execution with CPAchecker:I scripts/cpa.sh -ltl <path/program> -spec <path/specification>

Thomas Bunk LMU Munich, Germany 5 / 20

LTL Software Model Checking [1]Program P LTL property ϕ

Transition System TS Büchi automaton A¬ϕ

Product automatonTS ⊗ A¬ϕ

Emptiness checkL(TS⊗A¬ϕ) ?= ∅

P � ϕ P 2 ϕτ is CEX

yes no

[1] M. Vardi, P. Wolper: An Automata-Theoretic Approach to Automatic Program Verification [LICS’86]Thomas Bunk LMU Munich, Germany 6 / 20

Example [1]

1 i n t x , y ;2 whi le ( t r u e ) {3 x := ∗ ;4 y := 1 ;5 whi le ( x > 0) {6 x−−;7 i f ( x <= 1) {8 y := 0 ;9 }

10 }11 }

Listing 1: Program P aspseudocode

l0

l1

l2

l3

x := ∗; y := 1

x > 0

x−−

x <= 1; y := 0 !(x <= 1)

!(x > 0)

Figure: CFA of program P

[1] D. Dietsch, M. Heizmann, V. Langenfeld, and A. Podelski:Fairness modulo theory: A new approach to LTL software model checking. [CAV’15]

Thomas Bunk LMU Munich, Germany 7 / 20

Combining the CFA and LT property

1 i n t x , y ;2 whi le ( t r u e ) {3 x := ∗ ;4 y := 1 ;5 whi le ( x > 0) {6 x−−;7 i f ( x <= 1) {8 y := 0 ;9 }

10 }11 }

Listing 2: Program P

l0

l1

l2

l3

x := ∗; y := 1

x > 0

x−−

x <= 1; y := 0 !(x <= 1)

!(x > 0)

Figure: CFA of P

LTL property:ϕ = �(x > 0→ ♦(y = 0))

q0

q1

true

(x > 0) ∧ !(y == 0)

!(y == 0)

Figure: Büchi Automaton A¬ϕ

Thomas Bunk LMU Munich, Germany 8 / 20

Büchi-programl0q0

l1q0

l2q0

l3q0

l0q1

l1q1

l2q1

l3q1

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

!(x <= 1)

true

x <= 1; y:=0

true

x−−

true

x:=∗; y:=1

!(y == 0)

!(x > 0)

!(y == 0)

x > 0!(y == 0)

x <= 1; y:=0

!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

!(x > 0)

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 9 / 20

CPAchecker: Architecture

SourceCode

Spec

ResultsParser &CFA Builder

CEGARAlgorithm

CPAAlgorithm

DCACPA

LocationCPA

CallstackCPA

PredicateCPA

Func.Pt.CPA

Thomas Bunk LMU Munich, Germany 10 / 20

Local infeasibilityl0q0

l1q0

l2q0

l3q0

l0q1

l1q1

l2q1

l3q1

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

!(x <= 1)

true

x <= 1; y:=0

true

x−−

true

x:=∗; y:=1

!(y == 0)

!(x > 0)

!(y == 0)

x > 0!(y == 0)

x <= 1; y:=0

!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

!(x > 0)

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 11 / 20

Local infeasibilityl0q0

l1q0

l2q0

l3q0

l0q1

l1q1

l2q1

l3q1

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

!(x <= 1)

true

x <= 1; y:=0

true

x−−

true

x:=∗; y:=1

!(y == 0)

!(x > 0)

!(y == 0)

x > 0!(y == 0)

x <= 1; y:=0

!(y == 0)!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

!(x > 0)

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 11 / 20

Infeasibility of a finite prefixl0q0

l1q0

l2q0

l3q0

l0q1

l1q1

l2q1

l3q1

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

!(x <= 1)

true

x <= 1; y:=0

true

x−−

true

x:=∗; y:=1

!(y == 0)

!(x > 0)

!(y == 0)

x > 0!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 12 / 20

Infeasibility of a finite prefixl0q0

l1q0

l2q0

l3q0

l0q1

l1q1

l2q1

l3q1

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

!(x <= 1)

true

x <= 1; y:=0

true

x−−

true

x:=∗; y:=1

!(y == 0)

!(x > 0)

!(y == 0)

x > 0!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 12 / 20

Infeasibility of a finite prefixl0q0

l1q0

l2q0

l3q0

l0q1

l1q1

l2q1

l3q1

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

!(x <= 1)

true

x <= 1; y:=0

true

x−−

true

x:=∗; y:=1

!(y == 0)

!(x > 0)

!(y == 0)

x > 0!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 12 / 20

Infeasibility of a finite prefixl0q0

l1q0

l2q0

l3q0

l0q1

l1q1

l2q1

l3q1

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

!(x <= 1)

true

x <= 1; y:=0

true

x−−

true

x:=∗; y:=1

!(y == 0)

!(x > 0)

!(y == 0)

x > 0!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 12 / 20

Trace abstraction [1]

Goal:I Generalize infeasible error tracesI Exclude classes of infeasible traces

[1] M. Heizmann, J. Hoenicke, and A. Podelski: Software model checking for people who love automata. [CAV’13]Thomas Bunk LMU Munich, Germany 13 / 20

Example for Trace Abstraction

Approach:

1. take trace τ1

2. consider trace asautomaton A1

3. analyze correctness of A1

4. generalize automaton A1

p0

p1

perr

x:=∗; y:=1 ∧!(y == 0) ∧ (x > 0)

!(x > 0) ∧ !(y == 0)

>

x > 0

⊥

Thomas Bunk LMU Munich, Germany 14 / 20

Example for Trace Abstraction

Approach:

1. take trace τ1

2. consider trace asautomaton A1

3. analyze correctness of A1

4. generalize automaton A1

p0

p1

perr

x:=∗; y:=1 ∧!(y == 0) ∧ (x > 0)

!(x > 0) ∧ !(y == 0)

>

x > 0

⊥

Thomas Bunk LMU Munich, Germany 14 / 20

Example for Trace Abstraction

Approach:

1. take trace τ1

2. consider trace asautomaton A1

3. analyze correctness of A1

4. generalize automaton A1

p0

p1

perr

x:=∗; y:=1 ∧!(y == 0) ∧ (x > 0)

!(x > 0) ∧ !(y == 0)

>

x > 0

⊥

Thomas Bunk LMU Munich, Germany 14 / 20

Example for Trace Abstraction

Approach:

1. take trace τ1

2. consider trace asautomaton A1

3. analyze correctness of A1

4. generalize automaton A1

p0

p1

perr

x:=∗; y:=1 ∧!(y == 0) ∧ (x > 0)

!(x > 0) ∧ !(y == 0)

>

x > 0

⊥

Thomas Bunk LMU Munich, Germany 14 / 20

Trace Abstraction – Interpolant Based Approach

Approach:

1. take trace τ1

2. consider trace asautomaton A1

3. analyze correctness of A1

4. generalize automaton A1I add transitionsI merge locations

p0

p1

perr

x:=∗; y:=1 ∧!(y == 0) ∧ (x > 0)

. . .

!(x > 0) ∧ !(y == 0)

. . .

. . .

. . .

. . .

>

x > 0

⊥

Thomas Bunk LMU Munich, Germany 15 / 20

Trace Abstraction for Infeasible Prefixes

l0

l1

l2

l3

x := ∗; y := 1

x > 0

x−−

x <= 1; y := 0 !(x <= 1)

!(x > 0)

Figure: CFA of P

LTL property:ϕ = �(x > 0→ ♦(y = 0))

q0

q1

true

(x > 0) ∧ !(y == 0)

!(y == 0)

Figure: Büchi Automaton A¬ϕ

p0

p1

perr

x:=∗; y:=1 ∧!(y == 0) ∧ (x > 0)

. . .

!(x > 0) ∧ !(y == 0)

. . .

. . .

. . .

. . .

>

x > 0

⊥

Figure: Trace automaton A1

Thomas Bunk LMU Munich, Germany 16 / 20

Buechi Program after Refinementl0q0p0

l1q0p0

l2q0p1

l3q0p0

l0q1perr

l1q1p1

l2q1p1

l3q1p0

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

!(x <= 1)

true

x <= 1; y:=0

true

x−−

true

!(x > 0)

!(y == 0)

x > 0!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 17 / 20

Buechi Program after Refinementl0q0p0

>

l0q0perr⊥

l1q0p0

>

l1q0p1x > 0

l2q0p1 x > 0

l3q0p0>

l0q1perr ⊥

l1q1p1 x > 0

l2q1p1 x > 0

l3q1p0 >

!(x <= 1)

true

!(x > 0)

true

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

x <= 1; y:=0

true

x−−

true

!(x > 0)

!(y == 0)

x > 0!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 17 / 20

ω-Infeasibilityl0q0p0

l0q0perr

l1q0p0

l1q0p1

l2q0p1

l3q0p0

l0q1perr

l1q1p1

l2q1p1

l3q1p0

!(x <= 1)

true

!(x > 0)

true

x:=∗; y:=1

true

!(x > 0)

true

x > 0

true

x <= 1; y:=0

true

x−−

true

!(x > 0)

!(y == 0)

x > 0

!(y == 0)

!(x <= 1)

!(y == 0)

x−−

!(y == 0)

x:=∗; y:=1

!(y == 0) ∧ (x > 0)

x > 0!(y == 0) ∧ (x > 0)

x−−

!(y == 0) ∧ (x > 0)

!(x <= 1)

!(y == 0) ∧ (x > 0)

Thomas Bunk LMU Munich, Germany 17 / 20

LTL Software Model CheckingProgram P LTL property ϕ

Control-flow automaton CFA Büchi automaton A¬ϕ

Büchi ProgramB:=CFA⊗A¬ϕ

τ exists ?

τ = τ1τω2

τ1τ2 ∈ L(B)

τ1τ2 feasible ?

τ terminating ?

P � ϕno

P 2 ϕτ is CEX

no

yesnoB:=B ∪ refineF (τ)

yesyesB:=B ∪ refineω(τ)

Thomas Bunk LMU Munich, Germany 18 / 20

Outlook

I Implement Trace Abstraction algorithm for terminationarguments[1]

I Make use of Adjustable Block Encoding (ABE)

I ...

[1] M. Heizmann, J. Hoenicke, and A. Podelski: Termination analysis by learning terminating programs. [CAV’14]Thomas Bunk LMU Munich, Germany 19 / 20

Thank you for your attention!