arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 1509.09092cs.PLcs.LO
收藏

将数组验证问题编码为无数组Horn子句

An encoding of array verification problems into array-free Horn clauses

David Monniaux, Laure Gonnord

摘要:

自动验证程序的安全属性是困难的,如果程序作用于数组或其他形式的映射,则更难。存在许多方法来验证程序操作上的布尔和整数值(例如抽象的解释,反例引导的抽象细化使用插值),但转置它们数组属性已充满了困难。与大多数以前的方法相比,我们不引入一个新的抽象域或一个新的插值过程数组。相反,我们生成一个抽象的标量问题,并将其提供给一个预先存在的求解器,与可调precision.Our转换的问题表示使用霍恩条款,一个共同的格式与明确和明确的逻辑语义验证问题。我们的编码的一个重要特点是,它创建了一个非线性的霍恩问题,与树展开,即使下面的“平坦”的控制图结构通常会产生一个线性的霍恩问题,与线性展开。也就是说,我们的编码不能表示成另一个控制流图问题的编码,并真正利用霍恩子句格式的能力。我们说明了我们的方法与选择排序的功能正确性的完全自动化的证明。

英文摘要:

Automatically verifying safety properties of programs is hard, and it is even harder if the program acts upon arrays or other forms of maps. Many approaches exist for verifying programs operating upon Boolean and integer values (e.g. abstract interpretation, counterexample-guided abstraction refinement using interpolants), but transposing them to array properties has been fraught with difficulties.In contrast to most preceding approaches, we do not introduce a new abstract domain or a new interpolation procedure for arrays. Instead, we generate an abstraction as a scalar problem and feed it to a preexisting solver, with tunable precision.Our transformed problem is expressed using Horn clauses, a common format with clear and unambiguous logical semantics for verification problems. An important characteristic of our encoding is that it creates a nonlinear Horn problem, with tree unfoldings, even though following "flatly" the control-graph structure ordinarily yields a linear Horn problem, with linear unfoldings. That is, our encoding cannot be expressed by an encoding into another control-flow graph problem, and truly leverages the capacity of the Horn clause format.We illustrate our approach with a completely automated proof of the functional correctness of selection sort.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑