proving mutual termination of single threaded programs
Download
Skip this Video
Download Presentation
Proving Mutual Termination of single-threaded programs

Loading in 2 Seconds...

play fullscreen
1 / 28

Proving Mutual Termination of single-threaded programs - PowerPoint PPT Presentation


  • 96 Views
  • Uploaded on

Proving Mutual Termination of single-threaded programs. Dima Elenbogen Ofer Strichman Shmuel Katz Technion, Haifa, Israel. Notion of equivalence for this presentation. Goal: verification of the mutual termination of two similar programs . Mutual termination Given equal inputs,

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Proving Mutual Termination of single-threaded programs' - gloriann-stevens


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
proving mutual termination of single threaded programs

Proving Mutual Terminationof single-threaded programs

Dima Elenbogen Ofer Strichman Shmuel Katz

Technion, Haifa, Israel

notion of equivalence for this presentation
Notion of equivalence for this presentation

Goal: verification of the mutualterminationoftwosimilar programs.

Mutual termination

    • Given equal inputs,
      • P1 terminates ,P2 terminates
  • Undecidable

16:32:13

alternative termination of a single program
Alternative: termination of a single program
  • New tools have recently been developed:
    • Terminator
    • Mutant
  • Still, there are two major problems:
    • Incompleteness
    • Complexity

16:32:13

mutual termination vs proving termination
Mutual Termination vs. Proving Termination
  • Pros:
    • Computationally easier to check the mutual terminations of two programs than to prove the termination of each of them.
    • Fully automated.
      • It does not require finding a well-founded set.
    • Program do not necessarily terminate.
      • Termination check has nothing to say
      • Mutual termination can still say something useful.
  • Cons:
    • Defines a weaker notion.

16:32:13

goals
Goals
  • Develop proof rules for mutual termination
  • Present an algorithm for checking mutual termination, that
    • uses the proof rules, and
    • is sensitive to the magnitude of change rather than the magnitude of the programs

16:32:13

prerequisites
Prerequisites
  • Assume:
    • no loops (but there are recursive functions);
    • 1-1 mapping mapbetween the functions of both sides:
      • must intersect all cycles in the call graphs;
      • the mapped functions have the same signature

B:

A:

2map

f1’()

f1()

2map

f5’()

f2’()

f2()

f5()

f7’()

2map

f6()

f3()

f4()

f4’()

2map

16:32:13

mutual termination simple case
Mutual termination (simple case)
  • Consider the call graphs:
  • We want to prove that A, B are mutually terminating
    • How shall we handle the recursion ?

A

B

Side 1

Side 2

16:32:14

call equivalence
Call-equivalence
  • Definition: functions A,B are call-equivalent if…
    • For equal inputs:
      • For callees f,g s.t. (f,g) 2 map:
        • f is called ,g is called
        • f and g are called with the same arguments.

B(x, y) {

g(0,0)

if (cond2)

g(x,y)

if (cond3)

  • g(x,y)
  • }

A(x, y) {

if (cond1)

f(x,y)

f(0, 0)

}

The order and the number of calls do not matter

16:32:14

preliminary inference rule simple case
Preliminary inference rule (simple case)

B(w, z) {

if (cond2)

B(w1,z1)

else …

..

}

A(x, y) {

if (cond1)

A(x1,y1)

else …

}

A

B

call-equiv(A,B)

mutual-terminate(A, B)

(M-TERM-REC)

Side 1

Side 2

16:32:14

the premise is undecidable
The premise is undecidable

How can we prove the premise?

B(w, z) {

if (B(w’, z’) > …)

B(w1,z1)

else …

..

}

A(x, y) {

if (A(x’, y’) > …)

A(x1,y1)

else …

}

A

B

call-equiv(A,B)

mutual-terminate(A, B)

(M-TERM-REC)

Side 1

Side 2

16:32:14

uninterpreted functions
Uninterpreted functions
  • Replace the recursive calls with calls to functions that
    • over-approximateA, B,and
    • are terminating by construction
  • Natural candidates: Uninterpreted Functions
    • Abstract all functionality.
    • We only know they are consistent:x = y → UF(x) = UF(y)

call-equiv(A,B)

mutual-terminate(A, B)

(M-TERM-REC)

16:32:14

replacing recursive calls 1 2
Replacing recursive calls (1 / 2)
  • Let FUF , GUFbe F,G, after replacing the recursive call with a call to the corresponding uninterpreted functions.

F(x, y) {

if (cond1)

F(x1,y1)

else …

}

G(w, z) {

if (cond2)

G(w1,z1)

else …

..

}

F

G

Side 2

Side 1

16:32:14

replacing recursive calls 2 2
Replacing recursive calls (2 / 2)
  • Let FUF , GUFbe F,G, after replacing the recursive call with a call to the corresponding uninterpreted functions.

FUF(x, y) {

if (cond1)

UF(F)(x1,y1)

else …

}

GUF(w, z) {

if (cond2)

UF(G)(w1,z1)

else …

..

}

FUF

GUF

UF(G)

UF(F)

Side 2

Side 1

16:32:14

proving mutual termination
Proving mutual termination
  • Let FUF , GUFbe F,G, after replacing the recursive calls with calls to uninterpreted functions.
  • We can now rewrite the rule:

This premise is decidable

call-equiv(FUF,GUF)

mutual-terminate(F, G)

(M-TERM-SIMPLE)

16:32:14

general inference rule
General inference rule

Now we want to generalize from a single self loop to MSCCs in the call graphs:

  • Definition: is called in A]

∀(F, G) ∈ map. call-equiv(FUF,GUF)

∀(F, G) ∈ map. mutual-terminate(F, G)

(M-TERM)

16:32:14

connected msccs
Connected MSCCs

{(g,g’),(f,f’),(h,h’)} 2 map

Connected MSCCs…

  • Prove bottom-up
  • Abstract mutually terminating functions
  • Inline

g

g’

h

UF(h)

UF(h’)

h’

Side 2

Side 1

16:32:14

decomposition algorithm
Decomposition algorithm

Legend:

Mutually terminating pair

Mutual termination undecided yet

Could not prove mutual termination

Syntactically equivalent pair

check

Unpaired function

B:

A:

check

f1()

f1’()

f2’()

f2()

U

U

f5’()

f5()

f7’()

f4()

f4’()

f3()

f6()

U

U

check

16:32:14

mutual recursion

UF(g’)

UF(g)

Mutual recursion

{(g,g’),(f,f’)} 2 map

  • Find a sub-map that intersects all cycles, e.g., {(g,g’)}
  • Only when calling functions in this sub-map, replace with uninterpreted functions

g’

g

f

f ’

Side 2

Side 1

16:32:14

decomposition with mutual recursion
Decomposition with mutual recursion

Legend:

Mutually terminating pair

Mutual termination undecided yet

Could not prove mutual termination

Syntactically equivalent pair

Call-equivalent; mutual termination undecided yet

A:

B:

check

f1()

f1’()

f2()

f5()

U

U

U

U

U

U

f2’()

f5’()

U

U

U

U

U

U

16:32:14

the regression verification tool rvt
The Regression Verification Tool (RVT)
  • Given two C programs:
    • loops recursive functions.
    • Map functions, globals, etc.
  • After that:
    • Decompose to the granularity of pairs of functions
    • Use a C verification engine (CBMC)

16:32:14

slide21
RVT

Version A

Version B

  • Merge
  • Rename identical globals
  • Map functions/globals
  • Decompose
  • static analyses
  • call-equivalence
  • counterexample

RVT

C program

feedback

  • enforce equality of inputs
  • replace with UFs
  • assert call-equivalence

CBMC

16:32:14

improvements of completeness 1 2
Improvements of completeness (1 / 2)

Partial equivalence

    • Terminating executions of P1 and P2 on equal inputsresult in equal outputs.
  • Taking advantage of the partial equivalence of functions:
    • If we know that (f, g) ∈ mapare partially equivalent, then UF(f) = UF(g)
    • We welcome additional ideas how to refine our UFs.

16:32:14

improvements of completeness 2 2
Improvements of completeness (2 / 2)
  • Ignoring input arguments that do not affect the call-equivalence of a function:
    • This improves mapping, as some mapped function pairs may have different prototypes.

16:32:14

checking the termination of functions
Checking the termination of functions
  • Suppose we know that function A terminates. Can it help us to prove the termination of A’?
  • Define call-contain(A, A’) as:
    • For equal inputs :
      • For each pair (f, f’) 2map:

f ‘ is called in A’ with argument x

f is called in A with argument x

∀(F, F’) ∈ map. (term(F)∧call-contain(FUF ,F’UF))

∀(F, F’) ∈ map. term(F’)

(TERM)

16:32:14

value of mutual termination
Value of Mutual Termination

Full equivalence

    • P1 and P2 are partially equivalent and mutually terminate.
  • Introduced in:
  • Luckham, Park, and M. Paterson 1970

[On formalized computer programs]

  • Pratt1971 [Kernel equivalence of programs and proving kernel equivalence and correctness by test cases]
  • Regression verificationof full equivalence is an important problem.
  • Proving mutual termination is a crucial sub-task.

16:32:14

questions
Questions?..

16:32:14

using m term simple example 1 2

a,

b)

y)

x,

Using (M-TERM-SIMPLE): example (1/2)

unsigned gcd1UF

(unsigned a, unsigned b)

{ unsigned g;

if (b == 0)

g = a;

else {

a = a % b;

g = gcd1(b, a);

}

return g;

}

unsigned gcd2UF

(unsigned x, unsigned y)

{ unsigned z;

z = x;

if (y > 0)

z = gcd2(y, z % y);

}

return z;

}

?

=

UF2

term

UF1

16:32:14

using m term simple example 2 2
Using (M-TERM-SIMPLE): example (2/2)
  • Proving call-equiv(gcd1UF, gcd2UF)

Equal inputs

Equal guards

if called

then equal arguments

  • Valid. gcd1,gcd2aremutually terminating.

16:32:14

ad