Analyzing Automata with Presburger Arithmetic and Uninterpreted Function Symbols

1
Analyzing Automata with Presburger Arithmetic
and Uninterpreted Function Symbols

• Vlad Rusu and Elena Zinovieva
• IRISA / INRIA Rennes, France

2
Outline

• Motivation
• Background
• PF-Automata and Symbolic Analysis
• Conclusion

3
Motivation

• Algorithmic Methods (e.g. SPIN,SMV)
• J automatic
• L deal with finite-state systems
• Deductive Methods (e.g. PVS,STeP)
• L non automatic
• J deal with infinite-state systems

4
In this work
Model for Programs which is

• expressive (i.e. models common data structures
  counters, uninterpreted functions)
• infinite-state systems
• automatically analyzable by symbolic techniques

5
Results
6
Applications of Symbolic Analysis

• Automatic or interactive symbolic simulation
• Automatic verification (semi-decision
• procedure for safety)
• Coverage in testing

7
Presburger Arithmetic Uninterpreted Functions
Example ? y.( f(y) gt y ? ? k .(k 1 lt 2f(x
f(y1) ) ) )

• Satisfiability
• decidable for the quantifier-free fragment
• Shostak,1979
• undecidable in general Halpern,1991
• decidable for the semi-universal fragment

8
Ex Semi-Universal Formula

• u f(x1) f(y)1 ? ?i . ( f(i) y1 )
• 144243 144243
• j
  y

To decide it, instantiate i to every term to
which f is applied in j

• u f(x1) f(y)1 ? f(x1) y1 ? f(y)
  y1 ?
• 1444444424444443
• j
• ? ?i ?x1, y . ( f(i) y1 )
• 144424443
• y

u is satisfiable iff j is satisfiable
9
PF-Automata
10
Bounded Reachability Problem
11
Symbolic Reachability Analysis

• post ( Y) ?s . (r(s,s) ?Y(s)) - the
  post-image of the Y state predicate via
  transition relation r

W is reachable in n steps iff sat(post n(init) ?
W) (i.e. post n(init) ? W ? Ø)
12
Ex(1/2) Checking Reachability

• post 2(init)
• ?f0 ,f1 .(true ?
• f0(0) 0 ? f1(1) 1 ? ?k .(k ?1 ?
  f1(k) f0(k)) ?
• f1(1) 0 ? ?k .(true ? f2(k)
  f1(k)) ) (1)

13
Ex(2/2) Checking Reachability
sat( 1) iff sat( 2) iff state 2 is reachable
(2) is not satisfiable ? state 2 is not reachable
14
Conclusion Applications of Symbolic Analysis

• Automatic or interactive symbolic simulation
• Automatic verification (semi-decision procedure
  for safety)
• Automatic invariant generation
• Automatic proof of inductiveness (in context)
• Coverage in conformance testing