Interpolant Tree Automata and their Application in Horn Clause Verification

0.27 MB·

by  Bishoksan Kafle

Interpolant Tree Automata and their Application in Horn
Clause Verification ∗
BishoksanKafle JohnP.Gallagher
RoskildeUniversity,Denmark RoskildeUniversity,Denmark
[email protected] IMDEASoftwareInstitute,Spain
[email protected]
Thispaperinvestigatesthecombinationofabstractinterpretationoverthedomainofconvexpolyhe-
drawithinterpolanttreeautomata,inanabstraction-refinementschemeforHornclauseverification.
These techniques have been previously applied separately, but are combined in a new way in this
paper. The role of an interpolant tree automaton is to provide a generalisation of a spurious coun-
terexample during refinement, capturing a possibly infinite set of spurious counterexample traces.
In our approach these traces are then eliminated using a transformation of the Horn clauses. We
compare this approach with two other methods; one of them uses interpolant tree automata in an
algorithm for trace abstraction and refinement, while the other uses abstract interpretation over the
domainofconvexpolyhedrawithoutthegeneralisationstep.Evaluationoftheresultsofexperiments
onanumberofHornclauseverificationproblemsindicatesthatthecombinationofinterpolanttree
automatonwithabstractinterpretationgivessomeincreaseinthepoweroftheverificationtool,while
sometimesincurringaperformanceoverhead.
Keywords: Interpolanttreeautomata,Hornclauses,abstraction-refinement,traceabstraction.
1 Introduction
In this paper we combine two existing techniques, namely abstract interpretation over the domain of
convex polyhedra and interpolant tree automata in a new way for Horn clause verification. Abstract
interpretation is a scalable program analysis technique which computes invariants allowing many pro-
grampropertiestobeproven,butsuffersfromfalsealarms;safebutnotprovablysafeprogramsmaybe
indistinguishable from unsafe programs. Refinement is considered in this case. In previous work [27]
wedescribedanabstraction-refinementschemeforHornclauseverificationusingabstractinterpretation
andrefinementwithfinitetreeautomata. Inthatapproachrefinementeliminatesasinglespuriouscoun-
terexample in each iteration of the abstraction-refinement loop, using a clause transformation based on
a tree automata difference operation. In contrast to that work, we apply the method of Wang and Jiao
[33]forconstructinganinterpolanttreeautomatonfromaninfeasibletrace. Thisgeneralisesthetraceof
a spurious counterexample, recognising a possibly infinite number of spurious counterexamples, which
canthenbeeliminatedinoneiterationoftheabstraction-refinementloop. Wecombinethisconstruction
in the framework of [27]. The experimental results on a set of Horn clause verification problems are
reported,andcomparedwithboth[27]andtheresultsofWangandJiao[33]usingtraceabstractionand
refinement.
In Section 2 we introduce the key concepts of constrained Horn clauses and finite tree automata.
Section 3 contains the definitions of interpolants and the construction of a tree interpolant automaton
∗TheresearchleadingtotheseresultshasbeensupportedbytheEUFP7project318337,ENTRA-Whole-SystemsEnergy
TransparencyandtheEUFP7project611004,coordinationandsupportactionICT-Energy.
G.W.Hamilton,A.Lisitsa,A.P.Nemytykh(Eds):VPT2016
(cid:13)c Kafle&Gallagher
EPTCS216,2016,pp.104–117,doi:10.4204/EPTCS.216.6
Kafle&Gallagher 105
c1. fib(A, B):- A>=0, A=<1, B=1.
c2. fib(A, B) :- A>1, A2=A-2,
A1=A-1, B=B1+B2, fib(A1,B1), fib(A2,B2).
c3. false:- A>5, B<A, fib(A,B).
Figure1: ExampleCHCs(Fib)definingaFibonaccifunction.
following the techniques of Wang and Jiao [33]. In Section 4 we describe our algorithm combining
abstractinterpretationwithtreeinterpolantautomata,includinginSection4.1anexperimentalevaluation
andcomparisonwithotherapproaches. FinallyinSection5wediscussrelatedwork.
2 Preliminaries
AconstrainedHornclause(CHC)isafirstorderpredicatelogicformulaoftheform∀(φ∧p (X )∧...∧
1 1
p (X )→ p(X)) (k≥0), where φ is a first order logic formula (constraint) with respect to some back-
k k
groundtheoryand p ,...,p ,parepredicatesymbols. Weassume(wlog)thatX,X are(possiblyempty)
1 k i
tuplesofdistinctvariablesandφ isexpressedintermsofX, X,whichcanbeachievedbyaddingequali-
i
tiestoφ. p(X)istheheadoftheclauseandφ∧p (X )∧...∧p (X )isthebody. Thereisadistinguished
1 1 k k
predicatesymbolfalsewhichisinterpretedasfalse. Clauseswhoseheadisfalsearecalledintegritycon-
straints. Following the notation used in constraint logic programming a clause is usually written as
H ←φ,B ,...,B where H,B ,...,B stand for atomic formulas (atoms) p(X),p (X ),...,p (X ). A set
1 k 1 k 1 1 k k
ofCHCsissometimescalleda(constraintlogic)program.
An interpretation of a set of CHCs is represented as a set of constrained facts of the form A←φ
whereAisanatomandφ isaformulawithrespecttosomebackgroundtheory. A←φ representsaset
of ground facts Aθ such that φθ holds in the background theory (θ is called a grounding substitution).
AninterpretationthatsatisfieseachclauseinPiscalledamodelofP. Insomeworks[6,28],amodelis
alsocalledasolutionandweusetheminterchangeablyinthispaper.
Hornclauseverificationproblem. GivenasetofCHCsP,theCHCverificationproblemistocheck
whetherthereexistsamodelofP. ItcaneasilybeshownthatPhasamodelifandonlyifthefactfalse
isnotaconsequenceofP.
AnexamplesetofCHCs,encodingtheFibonaccifunctionisshowninFigure1. Sinceitsderivations
aretrees,itservesasaninterestingexamplefromthepointofviewofinterpolanttreeautomata.
Definition1(Finitetreeautomaton[7]) An FTA A is a tuple (Q,Q ,Σ,∆), where Q is a finite set of
f
states, Q ⊆Q is a set of final states, Σ is a set of function symbols, and ∆ is a set of transitions of the
f
form f(q ,...,q )→qwithq,q ,...,q ∈Qand f ∈Σ. WeassumethatQandΣaredisjoint.
1 n 1 n
WeassumethateachCHCinaprogramPisassociatedwithanidentifierbyamappingid :P→Σ.
P
An identifier (an element of Σ) is a function symbol whose arity is the same as the number of atoms in
theclausebody. Forinstanceaclause p(X)←φ,p (X ),...,p (X )isassignedafunctionsymbolwith
1 1 k k
arity k. As will be seen later, these identifiers are used to build trees that represent derivations using
the clauses. A set of derivation trees (traces) of a set of atoms of a program P can be abstracted and
representedbyanFTA.WeprovidesuchaconstructioninDefinition2.
Definition2(TraceFTAforasetofCHCs) Let P be a set of CHCs. Define the trace FTA for P as
A =(Q,Q ,Σ,∆)where
P f
106 InterpolantTreeAutomataandtheirApplicationinHornClauseVerification
• Q={p| pisa predicatesymbol of P}∪{false};
• Q ={false};
f
• Σisasetoffunctionsymbols;
• ∆ = {c (p ,...,p ) → p | wherec ∈ Σ, p(X) ← φ,p (X ),...,p (X ) ∈ P, c = id (p(X) ←
j 1 k j 1 1 k k j P
φ,p (X ),...,p (X ))}.
1 1 k k
TheelementsofL(A )arecalledtrace-termsortrace-treesorsimplytracesofProotedatfalse.
P
Example1 Let Fib be the set of CHCs in Figure 1. Let id map the clauses to identifiers c ,c ,c
Fib 1 2 3
respectively. ThenA =(Q,Q ,Σ,∆)where:
Fib f
Q = {fib,false}
Q = {false}
f
Σ = {c ,c ,c }
1 2 3
∆ = {c →fib, c (fib,fib)→fib,
1 2
c (fib)→false}
3
Similarly,wecanalsoconstructanFTArepresentingasingletrace. Itshouldbenotedthatthewhole
idea of representing program traces by FTAs is to use automata theoretic operations for dealing with
program traces, for example, removal of an undesirable trace from a set of program traces. Let P be
a set of CHCs and let t ∈L(A ). There exists an FTA A such that L(A )={t}. We illustrate the
P t t
constructionwithanexample.
Example2(TraceFTA) ConsidertheFTAinExample1. Lett =c (c (c ,c ))∈L(A ). ThenA =
3 2 1 1 P t
(Q,Q ,Σ,∆)isdefinedas:
f
Q = {e ,e ,e ,e }
1 2 3 4
Q = {e }
f 1
Σ = {c ,c ,c ,c }
1 2 3 4
∆ = {c →e , c →e , c (e ,e )→e ,
1 3 1 4 2 3 4 2
c (e )→e }
3 2 1
whereΣisthesameasinA andthestatese (i=1...4)representthenodesinthetrace-tree,withroot
P i
nodee asthefinalstate.
1
A trace-term is a representation of a derivation trees, called an AND-tree [32, 13] giving a proof of
anatomicformulafromasetofCHCs.
Definition3(AND-treeforatracetermT(t)(adaptedfrom[27])) LetPbeasetofCHCsandlett ∈
L(A ). An AND-tree corresponding to t, denote by T(t), is the following labelled tree, where each
P
nodeofT(t)islabelledbyanatom,aclauseidentifierandaconstraint.
1. Foreachsub-termc (t ,...,t )oftthereisacorrespondingnodeinT(t)labelledbyanatomp(X),
j 1 k
an identifier c such that c =id (p(X)←φ,p (X ),...,p (X )), and a constraint φ; the node’s
j j P 1 1 k k
children(ifk>0)arethenodescorrespondingtot ,...,t andarelabelledby p (X ),...,p (X ).
1 k 1 1 k k
2. The variables in the labels are chosen such that if a node n is labelled by a clause, the local
variablesintheclausebodydonotoccuroutsidethesubtreerootedatn.
WeassumethateachnodeinT(t)isuniquelyidentifiedbyanaturalnumber. Weomitt fromT(t)when
itisclearfromthecontext.
Kafle&Gallagher 107
c 1 c false φ
3 3 1
c 2 c fib(A,B) φ
2 2 2
c c 3 c fib(A2,B2) φ 4 c fib(A1,B1) φ
1 1 1 3 1 4
Figure 2: A trace-term c (c (c ,c )) of Fib (left) and its AND-tree (right), where φ ≡ A>5∧
3 2 1 1 1
B<A; φ ≡ A>1∧A2=A−2∧A1=A−1∧B=B1+B2; φ ≡ A2≥ 0∧A2≤ 1∧B2=1; φ ≡
2 3 4
A1≥ 0∧A1≤ 1∧B1=1.
TheformularepresentedbyanAND-treeT,representedbyF(T)is
1. φ,ifT isasingleleafnodelabelledbyaconstraintφ;or
2. φ∧(cid:86) (F(T))iftherootnodeofT islabelledbytheconstraintφ andhassubtreesT ,...,T .
i=1..n i 1 n
TheformulaF(T)whereT istheAND-treeinFigure2is
A>5∧B<A∧A>1∧A2=A−2∧A1=A−1∧B=B1+B2
A2≥ 0∧A2≤1∧B2=1∧A1≥0∧A1≤1∧B1=1
WesaythatanAND-treeT issatisfiableorfeasibleifF(T)issatisfiable,otherwiseunsatisfiableor
infeasible. Similarly, we say a trace-term is satisfiable (unsatisfiable) iff its corresponding AND-tree is
satisfiable(unsatisfiable). Thetrace-termc (c (c ,c ))inFigure2isunsatisfiablesinceF(c (c (c ,c )))
3 2 1 1 3 2 1 1
isunsatisfiable.
3 Interpolant tree automata
Refinementoftraceabstractionisanapproachtoprogramverification[19]. Inthisapproach, ifaprop-
erty is not provable in an abstraction of program traces then an abstract trace showing the violation of
the property is emitted. If such a trace is not feasible with respect to the original program, it is elim-
inated from the trace abstraction which is viewed as a refinement of the trace abstraction. The notion
of interpolant automata [19] allows one to generalise an infeasible trace to capture possibly infinitely
manyinfeasibletraceswhichcanthenbeeliminatedinonerefinementstep. Inthissection,werevisitthe
construction of an interpolant tree automaton [33] from an infeasible trace-tree. The automaton serves
asageneralisationofthetrace-tree;andweapplythisconstructioninHornclauseverification.
Definition4((Craig)Interpolant[10]) Given two formulas φ ,φ such that φ ∧φ is unsatisfiable, a
1 2 1 2
(Craig) interpolant is a formula I with (1) φ → I; (2) I∧φ → false; and (3) vars(I) ⊆ vars(φ ) ∩
1 2 1
vars(φ ). Aninterpolantofφ andφ isrepresentedbyI(φ ,φ ).
2 1 2 1 2
Theexistenceofaninterpolantimpliesthatφ ∧φ isunsatisfiable[29]. Similarly,ifthebackground
1 2
theory underlying the CHCs P admits (Craig) interpolation [10], then every infeasible derivation using
theclausesinPhasaninterpolant[28].
108 InterpolantTreeAutomataandtheirApplicationinHornClauseVerification
Example3(Interpolantexample) Let φ ≡ A2≤1∧A>1∧A2=A−2∧A1=A−1∧B=B1+B2
1
and φ ≡A>5∧B<A such that φ ∧φ is unsatisfiable. Since the formula I ≡A≤3 fulfills all the
2 1 2
conditionsofDefinition4,itisaninterpolantofφ andφ .
1 2
Given a node i in an AND-tree T, we call T the sub-tree rooted at i, φ the formula label of node i,
i i
F(T)theformulaofthesub-treerootedatnodeiandG(T),theformulaF(T)excepttheformulaF(T),
i i i
whichisdefinedasfollows:
1. true,ifT isasingleleafnodelabelledbyconstraintφ andthenodeisi;or
2. φ,ifT isasingleleafnodelabelledbyconstraintφ andthenodeisdifferentfromi;or
3. true,iftherootnodeofT islabelledbytheconstraintφ andthenodeisi;or
4. φ∧(cid:86) (G(T)) if the root node of T is labelled by the constraint φ, and the node is different
l=1..n l
fromiandhassubtreesT ,...,T .
1 n
Definition5(TreeInterpolantofanAND-tree([33])) Let T be an infeasible AND-tree. A tree inter-
polantTI(T)forT isatreeconstructedasfollows:
1. TherootnodeiofTI(T)islabelledbyi,theatomofthenodeiofT andtheformulafalse;
2. EachleafnodeiofTI(T)islabelledbyi,theatomofthenodeiofT andbyI(F(T),G(T));
i i
3. LetibeanyothernodeofT. WedefineF as(φ ∧(cid:86)n I )where(cid:86)n I (n≥1)istheconjunction
1 i k=1 k k=1 k
offormulasrepresentingtheinterpolantsofthechildrenofthenodeiinTI(T). Thenthenodeiof
TI(T)islabelledbyi,theatomofthenodeiofT andtheformulaI(F ,G(T)).
1 i
ThetreeinterpolantcorrespondingtoANDtreeinFigure2(b)isshowninFigure3(b).
1 c false φ 1 c false false
3 1 3
2 c fib(A,B) φ 2 c fib(A,B) A ≤ 3
2 2 2
3 c fib(A2,B2) φ 4 c fib(A1,B1) φ 3 c fib(A2,B2) A2 ≤ 1 4 c fib(A1,B1) true
1 3 1 4 1 1
Figure 3: AND tree of Figure 2 (left) and its tree interpolant (right). Let I represents an interpolant of
j
thenode j. ThenI ≡false;I ≡I(φ ,φ ∧φ ∧φ );I ≡I(φ ,φ ∧φ ∧I );I ≡I(I ∧I ∧φ ,φ ).
1 4 4 3 1 2 3 3 1 2 4 2 3 4 2 1
Sincethereisaone-onecorrespondencebetweenanAND-treeandatrace-term,wecandefineatree
interpolantforatrace-termasfollows:
Definition6(TreeInterpolantofatrace-termTI(t)) Given an infeasible trace-term t, its tree inter-
polant,representedasTI(t),isthetreeinterpolantofitscorrespondingAND-tree.
Definition7(InterpolantmappingΠ ) Given a tree interpolant TI for some tree, Π is a mapping
TI TI
fromtheatomlabelsandnodenumbersofeachnodeinTI totheformulalabelsuchthatΠ (Aj)=ψ
TI
whereAistheatomlabelandψ istheformulalabelatnode j.
Kafle&Gallagher 109
ForourexampleprogramΠ isthefollowing:
TI
{false1(cid:55)→false,fib2(A,B)(cid:55)→A≤3,fib3(A2,B2)(cid:55)→A≤1,fib4(A1,B1)(cid:55)→true}
Property1(Treeinterpolantproperty) LetTI(T)beatreeinterpolantforsomeinfeasibleAND-tree
T. Then
1. Π (ri)=falsewhereristheatomlabeloftherootofTI(T);
TI
2. foreachnode j withchildren j ,...,j (n≥0)thefollowingpropertyholds:
1 n
((cid:86)nk=0ΠTI(Ajk))∧φj →ΠTI(Aj)whereφj istheformulalabelofthenode j ofT;
3. foreachnode j thefollowingpropertyholds:
vars(Π (Aj))⊆(vars(F(T ))∩vars(G(T ))), where the formula F(T ) and G(T ) corresponds
TI j j j j
toT.
Definition8(InterpolanttreeautomatonforHornclausesAI=(Q,Q ,Σ,∆)[33]) Let P be a set of
t f
CHCs,t ∈L(A )beanyinfeasibletrace-termandTI(t)beatreeinterpolantoft. Letσ :As×J→Q
P
where σ maps an atom at node i∈J of TI(t) to an FTA state in Q. Define ρ :PredJ →Pred which
mapsapredicatenamewithsuperscripttoapredicatenameofP. Thentheinterpolantautomatonoft is
definedasanFTAAI suchthat
t
• Q={σ(A,i):Aistheatomlabel of thenodeiof TI(t)};
• F ={σ(A,i):Aistheatomlabel of theroot of TI(t)};
• ΣisasetoffunctionsymbolsofP;
• ∆={c(pj1,...,pjk)→ pj | cl= p(X)←φ,p (X ),...,p (X )∈P, c=id (cl), ρ(pi)= p,
1 k 1 1 k k P
ρ(pi )= p form=1..kand Π (pj)(X)←φ,Π (pj1)(X ),...,Π (pjk)(X )}.
m m TI TI 1 1 TI k k
Example4(Interpolantautomataforc (c (c ,c )))
3 2 1 1
Q = {fib2,fib3,fib4,error}
Q = {error}
f
Σ = {c ,c ,c }
1 2 3
∆ = {c →fib2,c →fib3,c →fib4,
1 1 1
c (fib2,fib2)→fib4,c (fib2,fib3)→fib2,
2 2
c (fib2,fib3)→fib4,c (fib2,fib4)→fib4,
2 2
c (fib3,fib2)→fib2,c (fib3,fib2)→fib4,
2 2
c (fib3,fib3)→fib2,c (fib3,fib3)→fib4,
2 2
c (fib3,fib4)→fib2,c (fib3,fib4)→fib4,
2 2
c (fib4,fib2)→fib4,c (fib4,fib3)→fib2,
2 2
c (fib4,fib3)→fib4,c (fib4,fib4)→fib4,
2 2
c (fib2)→error,c (fib3)→error}
3 3
The construction described in Definition 8 recognizes only infeasible traces terms of P as stated in
Theorem1.
Theorem1(Soundness) LetPbeasetofCHCsandt ∈L(A )beanyinfeasibletrace-term. Thenthe
P
interpolantautomatonAI recognisesonlyinfeasibletrace-termsofP.
t
110 InterpolantTreeAutomataandtheirApplicationinHornClauseVerification
Definition9(Conjunctiveinterpolantmapping) Given an interpolant mapping Π of a tree inter-
TI
polant TI, we define a conjunctive interpolant mapping for an atom label A of any node in TI, repre-
sented as Πc (A), to be the following formula Πc (A) = (cid:86) Π (Aj), where j ranges over the nodes
TI TI j TI
of TI. It is the conjunction of interpolants of all the nodes of TI with atom label A. The conjunctive
interpolantmappingofTI isrepresentedisΠc ={Πc (A)| Aistheatomlabel of TI}.
TI TI
Itisdesirablethattheinterpolanttreeautomatonofatracet∈L(A )recognizesasmanyinfeasible
P
traces as possible, in an ideal situation, all infeasible traces of P. This is possible under the condition
describedinTheorem2.
Theorem2(ModelandInterpolantAutomata) Lett∈L(A )beanyinfeasibletrace-term. IfΠc
P TI(t)
isamodelofP,thentheinterpolantautomatonoft recognisesallinfeasibletrace-termsofP.
4 Application to Horn clause verification
An abstraction-refinement scheme for Horn clause verification is described in [27] which is depicted
in Figure 4. In this, a set of CHCs P is analysed using the techniques of abstract interpretation over
the domain of convex polyhedra which produces an over-approximation M of the minimal model of P.
The set of traces used during the analysis can be captured by an FTA AM (see Definition 10). This
P
automaton recognizes all trace-terms of P except some infeasible ones. Some of the infeasible trace-
termsareremovedbytheabstractinterpretation. Pissolvedorsafe(thatis,ithasamodel)iffalse(cid:54)∈M.
If this is not the case, a trace-term t ∈L(AM) is selected and checked for feasibility. If the answer is
P
positive,Phasnomodel,thatis,Pisunsafe.
Otherwise t is considered spurious and this drives the refinement process. The refinement in [27]
consistsofconstructinganautomatonA(cid:48)whichrecognizesalltracesinL(AM)\L(A )andgenerating
P P t
a refined set of clauses from P and A(cid:48). The automata difference construction refines a set of traces
P
(abstraction), which induces refinement in the original program. The refined program is again fed to
the abstract interpreter. This process continues until the problem is safe, unsafe or the resources are
exhausted. WecallthisapproachRefinementofAbstractioninHornclausesusingFiniteTreeautomata,
RAHFTinshort.
The approach just described lacks generalisation of spurious counterexamples during refinement.
However, in our current approach, we generalise a spurious counterexample through the use of inter-
polant automata. Section 3 describes how to compute an interpolant automaton (taken from [33]) cor-
respondingtoaninfeasibleHornclausederivation. Wefirstconstructaninterpolantautomatonviz. AI
t
corresponding tot. In Figure 4, this is shown by a blue line (in the middle) connecting the Abstraction
and Refinement boxes. The refinement proceeds as in RAHFT with the only difference that A(cid:48) now
P
recognizes all traces in L(AM)\L(AI). We call this approach Refinement of Abstraction in Horn
P t
clausesusingInterpolantTreeautomata, RAHITinshort.
NextwebrieflydescribehowtogenerateanFTA,AM,correspondingtoasetofclausesPusingthe
P
approximation produced by abstract interpretation. Finally we show some experimental results using
ourcurrentapproachonasetofHornclauseverificationbenchmarks.
Obtaining an FTA from a program and a model. Let M be a set of constrained atoms of the form
p(X)←φ where pisaprogrampredicateandφ isaconstraintoverX. GivensuchansetM,defineγ to
M
bethemappingfromatomstoconstraintssuchthatγ (p(X))=φ foreachconstrainedfact p(X)←φ.
M
Kafle&Gallagher 111
AI–Abstractinterpretation
FTAM–Finitetreeautomatamanipulator CG–Clausesgenerator
Abstraction Refinement
CHCP safe CHCP
no
AM AM A(cid:48)
P false∈M? P P
AI M t ∈L(AM) AtI FTAM CG
P
A
t
yesandfeasible
P←P CHCP
1 1
unsafe
Figure 4: Abstraction-refinement scheme in Horn clause verification [27]. M is an approximation pro-
ducedasaresultofabstractinterpretation. A(cid:48) recognizesalltracesinL(AM)\L(A ).
P P t
M isamodelofP(calledasyntacticsolutionin[33])ifforeachclause p(X)←φ,p (X ),...,p (X )in
1 1 n n
P,φ∧(cid:86)n γ (p(X))→γ (p(X)).
i=1 M i i M
Given such an M, we construct an FTA corresponding to P, which is the same as A (Definition 2)
P
exceptthattransitionscorrespondingtoclauseswhosebodiesarenotsatisfiableinthemodelareomitted,
sincetheycannotcontributetofeasiblederivations.
Definition10(FTAdefinedbyamodel.) Let P be a set of CHCs and M be a model defined by a set
of constrained facts. Then the FTA AM =(Q,Q ,Σ,∆ ) where Q,Q and Σ are the same as for A
P f M f P
(Definition2)and∆ isthefollowingsetoftransitions.
M
∆ ={c(p ,...,p )→ p| id (c)= p(X)←φ,p (X ),...,p (X ),
M 1 n P 1 1 n n
SAT(φ∧(cid:86)n γ (p(X)))
i=1 M i i
Lemma1 LetPbeasetofclausesandMbeamodelofPthenL(AM)includesallfeasibletrace-terms
P
ofProotedatfalse.
Inourexperiments,theabstractinterpretationwasoverthedomainofconvexpolyhedra,yieldingasetof
constrainedfactswhereeachconstraintsisaconjunctionoflinearequalitiesandinequalitiesrepresenting
aconvexpolyhedron.
Example5(FTAproducedasaresultofabstractinterpretation) For our example program in Figure
1,theconvexpolyhedralabstractionproducesanover-approximationM whichisrepresentedas
M={fib(A,B)←A>=0,B>=1,−A+B>=0}
SincethereisnoconstrainedfactforfalseinM,thisisamodelfortheexampleprogram. Ourabstraction-
refinement approach terminates at this point. However for the purpose of example, we show the FTA
constructedfortheexampleprogramusingM. Sincethebodiesofeachclausesexcepttheintegritycon-
straint are satisfied under M, the FTA is same as the one depicted in Example 1 except the transition
c (fib)→false,whichisremovedbecauseofabstractinterpretation.
3
112 InterpolantTreeAutomataandtheirApplicationinHornClauseVerification
4.1 Experiments
Forourexperiment,wehavecollectedasetof68programsfromdifferentsources.
1. Asetof30programsfromSV-COMP’15repository1 [3](recursivecategory)andtranslatedthem
toHornclausesusinginter-proceduralencodingofSeaHorn[18,17]producing(mostly)non-linear
Hornclauses.
2. A set of 38 problems taken from the source repository2, compiled by the authors of the tool El-
darica [23]. This set consists of problems, among others, from the NECLA static analysis suite,
fromthepaper[25]. Thesetasksarealsoconsideredin[33]andareinterpretedoverintegerlinear
arithmetic.
Wemadethefollowingcomparisonbetweenthetools.
1. We compare RAHIT with RAHFT, which compares the effect of removing a set of traces rather
thanasingletrace.
2. We compare RAHIT with the trace-abstraction tool [33] (TAR from now on). RAHIT uses poly-
hedral approximation combined with trace abstraction refinement whereas TAR uses only trace
abstractionrefinement.
TheresultsaresummarizedinTable1.
Implementation: Most of the tools in our tool-chain depicted in Figure 4 are implemented in Ciao
Prolog [22] except the one for determinisation of FTA, which is implemented in Java following the
algorithm described in [14]. Our tool-chain obtained by combining various tools using a shell script
serves as a proof of concept which is not optimised at all. For handling constraints, we use the Parma
polyhedra library [1] and the Yices SMT solver [12] over linear real arithmetic. The construction of
tree interpolation uses constrained based algorithm presented in [30] for computing interpolant of two
formulas.
Description: In Table 1, Program represents a verification task, Time (secs) RAHFT and Time (secs)
RAHIT-respectivelyrepresentthetimeinsecondstakenbythethetoolRAHFTandRAHITrespectively
forsolvingagiventask. Similarly,thenumberofabstraction-refinement iterationneededinthesecases
tosolveataskarerepresentedby#Itr. RAHFTand#Itr. RAHIT.Similarly,Time(secs)TARand#Itr. TAR
representthetimetakenandthenumberofiterationsneededbythetoolTAR.Theexperimentswererun
onaMACcomputerrunningOSXon2.3GHzIntelcorei7processorand8GBmemory.
Discussion: The comparison between RAHFT and RAHIT would reflect purely the role of interpolant
treeautomatainHornclauseverification(Table1)sincetheonlydifferencebetweenthemistherefine-
ment part using (interpolant) tree automata. The results show that RAHIT is more effective in practice
thanitscounterpartRAHFT. Thisisjustifiedbythenumberoftasks61/68solvedbyRAHITusingfewer
iterationscomparedtoRAHFT,whichonlysolves56/68tasks. Thisisduetothegeneralisationofaspu-
rious counterexample during refinement, which also captures other infeasible traces. Since these traces
canberemovedinthesameiteration,it(possibly)reducesthenumberofrefinements,howeverthesolv-
ing time goes up because of the cost of computing an interpolant automaton. It is not always the case
1http://sv-comp.sosy-lab.org/2015/benchmarks.php
2https://github.com/sosy-lab/sv-benchmarks/tree/master/clauses/LIA/Eldarica
Kafle&Gallagher 113
that RAHIT takes less iterations for a task (for example Addition03 false-unreach) than RAHFT. This is
becausetherestructuringoftheprogramobtainedasaresultofremovingasetoftracesmayormaynot
favour polyhedral approximation. It is still not clear to us how to produce a right restructuring which
favours polyhedral approximation. RAHIT times out on cggmp2005 true-unreach whereas RAHFT
solves it in 5 iterations. We suspect that this is due to the cost of generating interpolant automata. We
are not sure about the complexity of interpolant generation algorithm we used (the size of the formula
generatedwasquitelargewithrespecttotheoriginalprogram,magnitudenotknown)andtherearesev-
eralcallstothetheoremprovertolabeleachtreenodewithinterpolants. Sothebiggeristhetrace-tree,
the longer it takes to compute the interpolant tree. In average, RAHIT needs 2.08 iterations and 11.40
secondstimetosolveataskwhereas RAHFTneeds2.32iterationsand10.55seconds.
Theuseofinterpolanttreeautomatafortracegeneralisationandthetreeautomatabasedoperations
fortrace-refinementaresameinbothRAHITandTAR.SinceTARisnotpubliclyavailable,wechosethe
samesetofbenchmarksusedbyTARforthepurposeofcomparisonandpresentedtheresults(theresults
corresponding to TAR are taken from [33]). The computer used in our experiments and in TAR [33]
have similar characteristics. RAHIT solves more than half of the problems only with abstract interpre-
tationoverthedomainofconvexpolyhedrawithoutneedinganyrefinement, whichindicatesitspower.
RAHIT solves33/38problemswhereasTARsolves28/38problems. Inaverage, RAHIT takeslesstime
than TAR. In many cases TAR solves a task faster than RAHIT, however it spends much longer time in
some tasks. Our current constraint solver is over linear real arithmetic. If we use it over linear integer
arithmetic then the results may differ. We made some observation with the problems boustrophedon.c,
boustrophedon expansed.c and cousot.correct (which are supposed to be interpreted over integers). In
them,ifwereplacestrictinequalities(>,<)withnon-strictinequalities(≥,≤)overintegers(forexam-
ple replace X >Y with X ≥Y +1), then we can solve them only with abstract interpretation without
refinementwhichwerenotsolvedbeforethetransformationusingoursolver. Ontheotherhand,RAHIT
timesoutfor mergesort.error whereasTARsolvesitinasingleiteration. Thisindicatesthatthechoice
of a spurious counterexample and the quality of interpolant generated from it for generalisation have
someeffectsonverification.
5 Related work
Horn Clauses, as an intermediate language, have become a popular formalism for verification [5, 15],
attracting both the logic programming and software verification communities [4]. As a result of these,
several verification techniques and tools have been developed for CHCs, among others, [17, 16, 26, 11,
27,24,23]. Tothebestofourknowledge,theuseofautomatabasedapproachforabstraction-refinement
of Horn clauses is relatively new [27, 33], though the original framework proposed for imperative pro-
gramsgoesbackto[19,20].
The work described in [27] uses FTA based approach for refining abstract interpretation over the
domain of convex polyhedra [8], which is similar to trace abstraction [19, 21, 33] with the following
differences. In [27], there is an interaction between state abstraction by abstract interpretation [9] and
trace abstraction by FTA but there is no generalisation of spurious counterexamples. On one hand,
[19,21,33]usetrace-abstractionwiththegeneralisationofspuriouscounterexamplesusinginterpolant
automata and may diverge from the solution due to the lack of right generalisation. On the other hand,
abstractinterpretation[9]isoneofthemostpromisingtechniquesforverificationwhichisscalablebut
suffersfromfalsealarms. Whencombinedwithrefinementfalsealarmscanbeminimized. Ourcurrent
worktakesthebestofbothoftheseapproaches.