Backward Analysis via over-Approximate Abstraction and under-Approximate Subtraction

Abstract

Abstract. We propose a novel approach for computing weakest liberal safe preconditions of programs. The standard approaches, which call for either underapproximation of a greatest fixed point, or complementation of a least fixed point, are often difficult to apply successfully. Our approach relies on a different decomposition of the weakest precondition of loops. We exchange the greatest fixed point for the computation of a least fixed point above a recurrent set, instead of the bottom element. Convergence is achieved using over-approximation, while in order to maintain soundness we use an under-approximating logical subtraction operation. Unlike general complementation, subtraction more easily allows for increased precision in case its arguments are related. The approach is not restricted to a specific abstract domain and we use it to analyze programs using the abstract domains of intervals and of 3-valued structures.

Necessary and Sufficient Preconditions via Eager Abstraction

“…We compute necessary and sufficient preconditions independently from the calling context of the procedure. Similar techniques for computing necessary preconditions are proposed by Miné [24] using a lower widening technique to perform a polyhedral backward analysis, and Bakhirkin et al [1] who combine over-approximative backward analysis with a subtraction operation to obtain under-approximations.…”

“…Input: formula ψF , ψE, transition constraint τ Output: set of predicates 1 Var P , P : set of predicates; 2 Var ψF , ψE: formula; 3 ψF := ψF ∨ pre(τ, ψF ); 4 ψE := ψE ∨ pre(τ, ψE); 5 if ψF ∧ ψE ≡ false then return ∅; 6 ; 7 Let τ.pc = ; 8 Let ψ F ≡ (ψF ∧ pc = ) be of the form (i∈I) ϕi; 9 Let ψ E ≡ (ψE ∧ pc = ) be of the form (j∈J) ϕ j ; 10 P := ∅;…”

An iterative approach to precondition inference using constrained Horn clauses

“…Most are from the repositories of state-of-the-art software verification tools such as DAGGER 1 (Gulavani et al 2008), TRACER 2 (Jaffar et al 2012), InvGen 3 (Gupta and Rybalchenko 2009), and from the TACAS 2013 Software Verification Competition (Beyer 2013, Control flow and Loops categories). 4 Other examples are from the literature on precondition generation, backwards analysis and parameter synthesis (Bakhirkin et al 2014;Miné 2012a;Miné 2012b;Moy 2008;Bakhirkin and Monniaux 2017;Cassez et al 2017) and manually translated to CHCs. These benchmarks are designed to demonstrate/test the strengths/usability of different tools and methods proposed to solve software verification, parameter synthesis and precondition generation problems and contain up to approximately 500 lines of code.…”

“…bakhirkin-fig3 (Bakhirkin et al 2014) (1 ≤ a ≤ 99 → b ≥ 1) ∧ (a ≤ 0 → b = 0) bakhirkin (Bakhirkin et al 2014) 1 ≤ a ≤ 60 ∨ a ≥ 100 mine (Miné 2012a) 0 ≤ a ≤ 5 mon fig1 (Bakhirkin and Monniaux 2017) a = b ∧ a ≥ 0 moy (Moy 2008) b < 1 ∨ (b < 2 ∧ a > 0) navas2 (crafted) a ≤ 99 ∨ b ≥ 100 simple function (Miné 2012b) 6 ≤ a ≤ 61 test both branches (Miné 2012b) 3 ≤ a ≤ 17 test nondet body (Miné 2012b) 6 ≤ a ≤ 13 test nondet cond (Miné 2012b) 3 ≤ a ≤ 17 test then branch (Miné 2012b) 10 ≤ a ≤ 20 fischer (Cassez et al 2017) a + 2c < b ∨ a < 0 ∨ b < 0 ∨ c ≤ 0 Jhala (Jhala and McMillan 2006) a < 0 ∨ a ≥ b ∨ c = d Ball SLAM (Ball et al 2004) b < c client ssh protocol b < a ∨ b < 2 ∨ a > 3 Beyer et al (2007) n ≤ i ∧ a + b = 3n…”

“…Moy (2008) presents a method for deriving sufficient preconditions (for use with a theorem prover), employing weakest-precondition reasoning and forward abstract interpretation to attempt to generalise conditions at loop heads. Bakhirkin et al (2014) observe that there may be an advantage in generalising an abstract complement operation to (abstract) logical subtraction, as this can improve opportunities to find a tighter approximation of a set of states. Miné (2012a) infers sufficient conditions for safety, not by instantiating a generic mechanism for complementation, but by designing all required purpose-built backward transfer functions.…”