On recursion-free Horn clauses and Craig interpolation

Abstract

One of the main challenges in software verification is efficient and precise analysis of programs with procedures and loops. Interpolation methods remain among the most promising techniques for such verification. To accommodate the demands of various programming language features, over the past years several extended forms of interpolation have been introduced. We give a precise ontology of such extended interpolation methods, and investigate the relationship between interpolation and fragments of constrained recursionfree Horn clauses. We also introduce a new notion of interpolation, disjunctive interpolation, which solves a more general class of problems in one step compared to previous notions of interpolants, such as tree interpolants or inductive sequences of interpolants. We present algorithms and complexity for construction of interpolants, as well as the corresponding decision problems for recursion-free Horn fragments. Finally, we give an extensive empirical evaluation using a solver for (recursive) Horn problems, in particular comparing the performance of tree interpolation and disjunctive interpolation for constraints modelling software verification tasks.

Choose Your Colour: Tree Interpolation for Quantified Formulas in SMT

“…Example 1 (Running example). Take the tree interpolation problem with nodes V = {123, 1, 23, 2, 3} and edges E = {(1, 123), (23,123), (2,23), (3,23)} (see also Fig. 1), where the partitions P = {1, 2, 3} are labelled with F (p) ≡ φ p where We recall that by symb(F (p)), we denote the uninterpreted function symbols occurring in the formula F (p).…”

“…In the last two decades, research reignited when interpolants proved useful for software verification, in particular for generating invariants [15]. Tree interpolants are useful for verifying programs with recursion [12], and for solving non-linear Horn-clause constraints [23], which can be used for thread modular reasoning [10,16] and verifying array programs [20]. For many verification problems, reasoning about first-order quantified formulas is needed.…”

Local refinement typing

“…F* [Swamy et al 2011] requires local annotations as described in § 2, Mochi [Unno et al 2013] requires no annotations but may diverge, and does not support uninterpreted functions which precludes all of our benchmarks. Similarly, existing Horn Solvers like µZ3 may diverge, while Eldarica [Rümmer et al 2015], HSF [Grebenshchikov et al 2012], and Spacer [Komuravelli et al 2016] do not support uninterpreted functions.…”

“…However, current Horn Clause solvers e.g. [Grebenshchikov et al 2012;Hoder and Bjørner 2012;Rümmer et al 2015] are based on CEGAR and interpolation and hence, to quote a recent survey [Bjørner et al 2015]: "mainly tuned for real and linear integer arithmetic and Boolean domains" rendering them unable to check any of our benchmarks which make extensive use of uninterpreted functions. Our work shows how to (1) algorithmically generate NNF clauses from typed, higher-order programs, in a way that preserves scoping, (2) use an optimized form of "unfolding" [Burstall and Darlington 1977;Pettorossi and Proietti 1994;Tamaki and Sato 1984] to synthesize the most precise type and (3) thereby, obtain a method for improving the speed, precision and completeness of refinement type checking.…”

Incremental Search for Conflict and Unit Instances of Quantified Formulas with E-Matching

“…In the last two decades, research reignited when interpolants proved useful for software verification, in particular for generating invariants [13]. Tree interpolants are useful for verifying programs with recursion [11], and for solving non-linear Horn-clause constraints [20], which can be used for thread modular reasoning [9,14] and verifying array programs [18]. For many verification problems, reasoning about first-order quantifiers is needed.…”