An iterative approach to precondition inference using constrained Horn clauses

Abstract

We present a method for automatic inference of conditions on the initial states of a program that guarantee that the safety assertions in the program are not violated. Constrained Horn clauses (CHCs) are used to model the program and assertions in a uniform way, and we use standard abstract interpretations to derive an over-approximation of the set ofunsafeinitial states. The precondition then is the constraint corresponding to the complement of that set, under-approximating the set ofsafeinitial states. This idea of complementation is not new, but previous attempts to exploit it have suffered from the loss of precision. Here we develop an iterative specialisation algorithm to give more precise, and in some cases optimal safety conditions. The algorithm combines existing transformations, namely constraint specialisation, partial evaluation and a trace elimination transformation. The last two of these transformations perform polyvariant specialisation, leading to disjunctive constraints which improve precision. The algorithm is implemented and tested on a benchmark suite of programs from the literature in precondition inference and software verification competitions.

Polyvariant Program Specialisation with Property-based Abstraction

“…The usefulness of specialisation as a component in program verification tools has been established in many works, including [28,21,7,18] to name only a few. Fioravanti et al investigated the trade-offs of polyvariance with efficiency and precision when using specialisation as a verification tool [11].…”

“…Thus implicitly there are two distinct loops separated by x--; and this leads to the polyvariant specialisation shown in Figure 2 The main contribution of this paper is a specialisation algorithm that performs polyvariant specialisation. Instances of this algorithm have been previously used and briefly described [18,19,9] but these papers did not present and discuss the general algorithm. A key question is the control of polyvariance; in general there could be many (even an infinite number) of possible variants of a given program point.…”

“…Pre-condition inference. In [18], Algorithm 1 was used as a component in an algorithm for computing sufficient conditions for safety of imperative programs encoded as CHCs. In many cases, the safety condition is a disjunction.…”

“…Example 4 Consider the example in Figure 8 taken from [18]. Note that the translation to CHCs corresponds to a backwards flow of control from the error predicate false to the program start predicate init.…”

Bounded Symbolic Execution for Runtime Error Detection of Erlang Programs

“…The specialized CLP clauses may enable more efficient bounded verification, and they can also be used as input to other tools for analysis and verification (such as constraint-based analyzers [3,11] and SMT solvers [8,14]), which have already been shown to be effective in other contexts [2,4,5]. Moreover, the specialized clauses can be used to apply backward analysis techniques for CLP programs based on abstract interpretation (see, for instance, [9,12]). Backward analysis aims at deriving from a property that is expected to hold at the end of the execution of a program, conditions on the query which guarantee that the desired property indeed holds.…”