\documentclass[t]{beamer}
\mode<presentation>

\newcommand{\lecnumber}{12}

\include{cocmacros}
\newcommand{\uuline}[1]{\underline{\underline{#1}}}
\newcommand{\ures}[3]{
  \begin{array}{c@{\hspace*{2em}}c} 
    #1 & #2 \\ \hline \multicolumn{2}{c}{#3} 
  \end{array}}
\newcommand{\uex}{\underline{Example}}
\newcommand{\un}{\underline{Note}}
\newcommand{\utitle}[1]{\underline{#1}\\\smallskip}

\title{\lecnumber. Invariant Generation}
\date{}
\institute[Stanford University]

\begin{document}

\setbeamertemplate{footline}[text line]
{
	%\begin{large}
	\hspace*{\stretch{1}}\lecnumber - \insertframenumber \bigskip
	%\end{large}
}

\begin{frame}[c]
\Large
\textsc{The Calculus of Computation:}\\
Decision Procedures with\\
Applications to Verification

\bigskip
\bigskip
by\\
Aaron Bradley\\
Zohar Manna

\bigskip
\bigskip
Springer 2007
\end{frame}

\begin{frame}
	\titlepage
\end{frame}

\newcommand{\conceptbox}[2]{
  #1
  \hspace*{2em}\begin{minipage}[t]{27em}
  #2
  \end{minipage} \\
}

\begin{frame}
\utitle{Invariant Generation}
Discover inductive assertions of programs\\
$\bullet$ General procedure\\
$\bullet$ Concrete analysis\\
\begin{itemize}
\item \underline{interval analysis}\\
invariants of form\\
\qquad $c \le v$ or $v \le c$\\
for program variable $v$ and constant $c$
\item \underline{Karr's analysis}\\
invariants of form\\
\qquad $c_0 + c_1 x_1 + \cdots + c_n x_n = 0$\\
for program variables $x_i$ and constants $c_i$
\end{itemize}

\bigskip
Other invariant generation algorithms in literature:
\begin{itemize}
\item linear inequalities\\
$c_0 + c_1 x_1 + \cdots + c_n x_n \le 0$
\item polynomial equalities and inequalities
\end{itemize}
\end{frame}


\begin{frame}
\frametitle{Background}
\utitle{Weakest Precondition}
\begin{figure}[tb]
\centering
\begin{minipage}{.4\textwidth}
\psset{unit=.45mm}
\pspicture(0,0)(120,100)
\psccurve(10,70)(60,60)(70,10)(20,20)(10,70)
\rput{0}(30,40){$\bullet s$}
\rput{0}(40,20){$\wpre{F}{S}$}
\psccurve(110,90)(100,40)(50,30)(60,80)(110,90)
\rput{0}(100,90){$\bullet s'$}
\rput{0}(80,40){$F$}
\pscurve[linestyle=dashed]{->}(35,45)(65,55)(95,85)
\rput{0}(70,55){$S$}
\endpspicture
\end{minipage}
\end{figure}

For FOL formula $F$ and program statement $S$,
the \underline{weakest precondition} $\wpre{F}{S}$ is a FOL formula s.t.
if for state $s$
\[
s \Models \wpre{F}{S}
\]
and if statement $S$ is executed on state $s$ to produce state $s'$,
then
\[
s' \Models F~.
\]
\end{frame}

\begin{frame}
In other words, the weakest precondition moves a formula backwards
over a series of statements:\\
for $F$ to hold after executing $S_1;\ldots;S_n$,\\
$\wpre{F}{S_1;\ldots;S_n}$ must hold before executing the statements.  

\bigskip
For \underline{assume} and assignment statements
\begin{itemize}
\item $\wpre{F}{\piassume c} \Bequiv c \bimplies F$, and
\item $\wpre{F[v]}{v \pia e} \Bequiv F[e]$;
\end{itemize}
and on sequences of statements $S_1;\ldots;S_n$:
\[
\wpre{F}{S_1;\ldots;S_n} \Bequiv \wpre{\wpre{F}{S_n}}{S_1;\ldots;S_{n-1}}~.
\]


\end{frame}

\begin{frame}
\utitle{Strongest Postcondition}
\begin{figure}[tb]
\centering
\begin{minipage}{.4\textwidth}
\psset{unit=.45mm}
\pspicture(0,0)(120,100)
\psccurve(70,70)(60,20)(10,10)(20,60)(70,70)
\rput{0}(30,40){$\bullet s_0$}
\rput{0}(40,20){$F$}
\psccurve(50,100)(100,90)(110,40)(60,50)(50,100)
\rput{0}(90,80){$\bullet s$}
\rput{0}(90,45){$\spost{F}{S}$}
\pscurve[linestyle=dashed]{->}(35,45)(65,55)(85,75)
\rput{0}(70,55){$S$}
\endpspicture
\end{minipage}
\end{figure}
For FOL formula $F$ and program statement $S$,
the \underline{strongest postcondition} $\spost{F}{S}$ is a FOL formula s.t.\\
if $s$ is the current state and
\[
s \Models \spost{F}{S}
\]
then statement $S$ was executed from a state $s_0$ s.t.
\[
s_0 \Models F~.
\]
\end{frame}

\begin{frame}

\begin{itemize}
\item On \underline{assume} statements,
\[
\spost{F}{\piassume c} \Bequiv c \band F~,
\]
for if program control makes it past the statement, then $c$ must
hold.

\item Unlike in the case of $\mathsf{wp}$, there is no simple definition of
$\mathsf{sp}$ on assignments:
\[
\spost{F[v]}{v \pia e[v]} \Bequiv \exists v^0.\ v = e[v^0] \band F[v^0]~.
\]

\item On a sequence of statements
$S_1;\ldots;S_n$:
\[
\spost{F}{S_1;\ldots;S_n} \Bequiv \spost{\spost{F}{S_1}}{S_2;\ldots;S_n}~.
\]
\end{itemize}


\end{frame}

\begin{frame}
\uex: Compute
\begin{align*}
\spost{&i \ge n}{i \pia i + k} \\
&\hspace*{1em} \mbox{} \Bequiv \exists i^0.\ i = i^0 + k \band i^0 \ge n \\
&\hspace*{1em} \mbox{} \Bequiv i - k \ge n
\end{align*}
since $i^0 = i - k$.

\bigskip
\uex: Compute
\begin{align*}
\spost{&i \ge n}{\piassume k \ge 0;\ i \pia i + k} \\
&\hspace*{1em} \mbox{} \Bequiv \spost{\spost{i \ge n}{\piassume k \ge 0}}{i \pia i + k} \\
&\hspace*{1em} \mbox{} \Bequiv \spost{k \ge 0 \band i \ge n}{i \pia i + k} \\
&\hspace*{1em} \mbox{} \Bequiv \exists i^0.\ i = i^0 + k \band k \ge 0 \band i^0 \ge n \\
&\hspace*{1em} \mbox{} \Bequiv k \ge 0 \band i - k \ge n
\end{align*}

\end{frame}

\begin{frame}
\utitle{Verification Condition}
VCs in terms of $\mathsf{wp}$:
\[
\htrip{F}{S_1;\ldots;S_n}{G}:\
F \Bimplies \wpre{G}{S_1;\ldots;S_n}~.
\]
VCs in terms of
$\mathsf{sp}$:
\[
\htrip{F}{S_1;\ldots;S_n}{G}:\
\spost{F}{S_1;\ldots;S_n} \Bimplies G~.
\]

\end{frame}

\begin{frame}
\uuline{Static Analysis}: basic definition\\
\begin{itemize}
\item Program $P$ with \underline{locations} $\locs$ ($L_0$ --- initial location)
\item \underline{Cutset} of $\locs$\\
each path from one \underline{cutpoint}
(location in the cutset) to the next cutpoint is \underline{basic path}
(does not cross loops)
\item \underline{Assertion map}\\
\qquad $\mu:\ \locs \rightarrow \mathsf{FOL}$\\
(map from $\locs$ to first-order assertions).\\
It is \underline{inductive} (\underline{inductive map}) if for each basic path

\noindent\rule[.5ex]{.4\textwidth}{.5mm}\hspace*{\stretch{1}}($\cdot$)\hspace*{\stretch{1}}\rule[.5ex]{.4\textwidth}{.5mm}\nopagebreak\newline
$\begin{array}{l}
  L_i:\ \piassert \mu(L_i) \\
  S_i; \\
  \hspace*{1ex}\vdots \\
  S_j; \\
  L_j:\ \piassert \mu(L_j)
\end{array}$

\rule[.5ex]{.92\textwidth}{.5mm}

for $L_i,L_j \in \locs$, the verification condition\\
\qquad $\htrip{\mu(L_i)}{S_i;\ldots;S_j}{\mu(L_j)}$ \hspace{\stretch{1}} (VC)\\
is valid.
\end{itemize}
\end{frame}

\begin{frame}
\uuline{Invariant Generation}\\
\smallskip
Find inductive assertion maps $\mu$ s.t. the $\mu(L_i)$ satisfies (VC) for all basic paths.

\bigskip
\uuline{Method}: \underline{Symbolic execution} (\underline{formward propagation})
\begin{itemize}
\item Initial map $\mu_0$:
\[
\begin{array}{ll}
\mu(L_0) \pia F_{\mathsf{pre}}~,
& \mbox{and}\\
\mu(L) \pia \false & \mbox{for} \quad L \in \locs \setminus \set{L_0}.
\end{array}
\]
\item Maintain set $S \subseteq \locs$ of locations that still need processing. Initially, let $S = \set{L_0}$.  Terminate when $S =
\emptyset$.
\item \underline{Iteration} $i$: We have so far constructed $\mu_i$.
Choose some $L_j \in S$ to process and remove it from $S$.
\end{itemize}
\end{frame}

\begin{frame}
\underline{For each basic path} (starting at $L_j$)\\
\noindent\rule[.5ex]{.45\textwidth}{.5mm}\hspace*{\stretch{1}}($\cdot$)\hspace*{\stretch{1}}\rule[.5ex]{.45\textwidth}{.5mm}\nopagebreak\newline
$\begin{array}{l}
  L_j:\ \piassert \mu(L_j) \\
  S_j; \\
  \hspace*{1ex}\vdots \\
  S_k; \\
  L_k:\ \piassert \mu(L_k)
\end{array}$

\rule[.5ex]{\textwidth}{.5mm}

compute and set\\
\qquad $\mu(L_k) \Bequiv \mu(L_k) \bor \spost{\mu(L_j)}{S_j;\ldots;S_k}$

\underline{If}\\
\qquad $\spost{\mu(L_j)}{S_j;\ldots;S_k} \Bimplies \mu_i(L_k)$

\smallskip
that is, if \underline{$\mathsf sp$} does not represent new states not already represented in
$\mu_i(L_k)$, then $\mu_{i+1}(L_k) \Bequiv \mu_i(L_k)$ (nothing new is learned)

\smallskip
\underline{Otherwise} add $L_k$ to $S$.\\
For all other locations $L_\ell \in \locs, \mu_{i+1}(L_\ell) \Bequiv \mu_i(L_\ell)$

\smallskip
When $S = \emptyset$ (say iteration $i^*$), then $\mu_{i^*}$ is an inductive map.

\end{frame}

\begin{frame}
The algorithm\\
\begin{figure}
\[
\begin{mlblock}
  \begin{mlfunction}{ForwardPropagate}{P\ F_{\mathsf{pre}}\ \locs}
    S \mlassign \set{L_0}; \\
    \mu(L_0) \mlassign F_{\mathsf{pre}}; \\
    \mu(L) \mlassign \false\ \mlkwd{for}\ L \in \locs \setminus \set{L_0}; \\
    \begin{mlwhile}{S \ne \emptyset}
      \mlsmalllet{L_j}{\mlfn{choose}\ S} \\
      S \mlassign S \setminus \set{L_j}; \\
	  \begin{mlblock}\mlkwd{foreach}\ {L_k \in \mathsf{succ}(L_j)}\ \mlkwd{do} 
		\hspace*{\stretch{1}}
		\left[
		 \begin{array}{@{}l@{}}
		  \mbox{$L_k \in \mathsf{succ}(L_j)$ is a \defni{successor}\index{successor location} of $L_j$}\\
		  \mbox{if there is a basic path from $L_j$ to $L_k$}
		 \end{array}
		 \right]\\ 
		\mlindent\begin{mlblock}
	\mlsmalllet{F}{\spost{\mu(L_j)}{S_j;\ldots;S_k}} \\
	\mlif F \not\Rightarrow \mu(L_k) \\
	\mlthen \begin{mlblock}
	  \mu(L_k) \mlassign \mu(L_k) \bor F; \\
	  S \mlassign S \cup \set{L_k};
	\end{mlblock} \\
	   \end{mlblock} \\ \mlkwd{done;}\end{mlblock}
    \end{mlwhile} \\
    \mu
  \end{mlfunction}
\end{mlblock}
\]
\end{figure}

\end{frame}

\begin{frame}
\underline{Problem}: algorithm may not terminate\\
\smallskip
\uex: Consider loop with integer variables $i$ and $n$:\\
\qquad $\begin{multiline}
  \piassert\piloc{L_0}: i = 0 \band n \ge 0; \\
  \piwhilestmt{
    \piloc{L_1}:\ ?
  }{i < n}{
    i \pia i + 1;
  }
\end{multiline}$

There are two basic paths:\newline
\begin{pipath}{1}
\piassert\piloc{L_0}:\ i = 0 \band n \ge 0; \\
\piassert\piloc{L_1}:\ ?;
\end{pipath}
and\newline
\begin{pipath}{2}
\piassert\piloc{L_1}:\ ?; \\
\piassume i < n; \\
i \pia i + 1; \\
\piassert\piloc{L_1}:\ ?;
\end{pipath}

\end{frame}

\begin{frame}
\begin{itemize}
\item Initially, \\
\smallskip
\qquad \fbox{
$\begin{array}{@{}rcl@{}}
\mu(L_0) & \Bequiv & i = 0 \band n \ge 0 \\
\mu(L_1) & \Bequiv & \false
\end{array}$
}
\item Following path \pipathn{1} results in setting\\
\smallskip
\qquad $\mu(L_1) \pia \mu(L_1) \bor (i = 0 \band n \ge 0)$\\
\smallskip
$\mu(L_1)$ was $\false$, so that it becomes\\
\smallskip
\qquad \fbox{$\mu(L_1) \Bequiv i = 0 \band n \ge 0~.$}
\item On the next iteration, following path \pipathn{2} yields
\[
\mu(L_1) \pia \mu(L_1) \bor \spost{\mu(L_1)}{\piassume i < n;\ i \pia i + 1}~.
\]
Currently $\mu(L_1) \Bequiv i = 0 \band n \ge 0$, so
\begin{align*}
F:\ \spost{&i = 0 \band n \ge 0}{\piassume i < n;\ i \pia i + 1} \\
& \mbox{} \Bequiv \spost{i < n \band i = 0 \band n \ge 0}{i \pia i + 1} \\
& \mbox{} \Bequiv \exists i^0.\ i = i^0 + 1 \band i^0 < n \band i^0 = 0 \band n \ge 0 \\
& \mbox{} \Bequiv i = 1 \band n > 0
\end{align*}
\end{itemize}
\end{frame}

\begin{frame}
\begin{itemize}
\item[]
Since the implication\\
\smallskip
\qquad $\underbrace{i = 1 \band n > 0}_F \Bimplies \underbrace{i = 0 \band n \ge 0}_{\mu(L_1)}$\\
\smallskip
is invalid,\\
\smallskip
\qquad \fbox{$\mu(L_1) \Bequiv \underbrace{(i = 0 \band n \ge 0)}_{\mu(L_1)} \bor \underbrace{(i = 1 \band n > 0)}_{F}$}\\
\smallskip
at the end of the iteration.

\item At the end of the next iteration,\\
\smallskip
\qquad \fbox{$\mu(L_1) \Bequiv 
\begin{array}{@{}l}
\underbrace{
(i = 0 \band n \ge 0) \bor 
(i = 1 \band n > 0)
}_{\mu(L_1)}\\
\bor
\underbrace{
(i = 2 \band n > 1)
}_{F}
\end{array}$}
 
\end{itemize}
\end{frame}

\begin{frame}
\begin{itemize}
\item At the end of the $k$th iteration,\\
\smallskip
\qquad \fbox{$\mu(L_1) \Bequiv 
\begin{array}{@{}l}
(i = 0 \band n \ge 0) \bor 
(i = 1 \band n \ge 1) \\
\mbox{} \bor \cdots \bor
(i = k \band n \ge k)
\end{array}$}\\
\smallskip
It is never the case that the implication
\[
\begin{array}{@{}c@{}}
i = k \band n \ge k
\\ \Downarrow \\
(i = 0 \sband n \ge 0) \sbor 
(i = 1 \sband n \ge 1)
\sbor \cdots \sbor
(i = k - 1 \sband n \ge k - 1)
\end{array}
\]
is valid, so the main loop of \underline{while} never finishes.

\item However, it is obvious that
\[
0 \le i \le n
\]
is an inductive annotation of the loop.
\end{itemize}
\end{frame}

\begin{frame}
\underline{Solution}: Abstraction\\
\bigskip
A state $s$ is \underline{reachable} for program $P$ if it appears in
some computation of $P$.

\bigskip
The problem is that $\mlfn{ForwardPropagate}$ computes the \underline{exact}
set of reachable states.

\bigskip
Inductive annotations usually over-approximate the set of reachable states:
every reachable state $s$ satisfies the annotation, but other unreachable
states can also satisfy the annotation.

\bigskip
\underline{Abstract interpretation} cleverly over-approximate the reachable
state set to guarantee termination.

\bigskip
Abstract interpretation is constructed in 6 steps.
\end{frame}

\begin{frame}
{\bf Step 1: Choose an abstract domain $D$.}

\bigskip
The \defn{abstract domain} $D$ is a syntactic class of $\Sigma$-formulae of some theory $T$.
\begin{itemize}
\item \defn{interval abstract domain} $\domint$ consists of
conjunctions of $\srat$-literals of the forms
\[
c \le v
\quad\mbox{and}\quad
v \le c~,
\]
for constant $c$ and program variable $v$.
\item \defn{Karr's abstract domain} $\domkarr$ consist of conjunctions of
$\srat$-literals of the form
\[
c_0 + c_1 x_1 + \cdots + c_n x_n = 0~,
\]
for constants $c_0, c_1, \ldots, c_n$ and variables $x_1, \ldots, x_n$.
\end{itemize}

\end{frame}

\begin{frame}
{\bf Step 2: Construct a map from FOL formulae to $D$.}

\bigskip
Define
\[
\nu_D: \mathsf{FOL} \rightarrow D
\]
to map a FOL formula $F$ to element $\nu_D(F)$ of $D$,
with the property that for any $F$,
\[
F \Bimplies \nu_D(F)~.
\]

\uex:
\[
F:\ i = 0 \band n \ge 0
\]
at $L_0$ of the loop can be represented in
the interval abstract domain by
\[
\nu_{\domint}(F):\ 0 \le i \band i \le 0 \band 0 \le n
\]
and in Karr's abstract domain by
\[
\nu_{\domkarr}(F):\ i = 0
\]
with some loss of information.
\end{frame}

\begin{frame}
{\bf Step 3: Define an abstract $\mathsf{sp}$.}

\bigskip
Define an \defn{abstract strongest postcondition}\index{strongest
postcondition!abstract} $\maspost_D$ for assumption and assignment
statements such that
\[
\spost{F}{S} \Bimplies \aspost{D}{F}{S}
\quad\mbox{and}\quad 
\aspost{D}{F}{S} \in D
\]
for statement $S$ and $F \in D$.

\begin{itemize}
\item statement $\piassume c$:
\[
\spost{F}{\piassume c} \Bequiv c \band F~.
\]
Conjunction $\band$ is used.

Define abstract conjunction $\sqcap_D$, such that
\[
F_1 \sband F_2 \Bimplies F_1 \aband{D} F_2
\quad\mbox{and}\quad
F_1 \aband{D} F_2 \in D
\]
for $F_1, F_2 \in D$.  Then if $F \in D$,
\[
\aspost{D}{F}{\piassume c} \Bequiv \nu_D(c) \aband{D} F~.
\]
If the abstract domain $D$ consists of conjunctions of literals,
$\sqcap_D$ is just $\wedge$. For example, in the interval domain,
\[
\aspost{\domint}{F}{\piassume c} \Bequiv \nu_{\domint}(c) \band F~.
\]
\end{itemize}
\end{frame}

\begin{frame}
\begin{itemize}
\item assignment statements:\\
 More complex, for suppose that we use the standard definition
\[
\spost{F[v]}{v \pia e[v]} \Bequiv \underbrace{\exists v^0.\ v = e[v^0] \band F[v^0]}_G~,
\]
which requires existential quantification.  Then, later, when we
compute the validity of
\[
G \Bimplies \mu(L)~, \quad \mbox{i.e.,} \quad \forall \vb.\ G \bimplies \mu(L)~,
\]
$\mu(L)$ can contain existential quantification, resulting in a
quantifier alternation.  Most decision procedures, apply
only to quantifier-free formulae.  Therefore, introducing existential
quantification in $\maspost$ is undesirable.
\end{itemize}
\end{frame}

\begin{frame}
{\bf Step 4: Define abstract disjunction.}

\medskip
Disjunction is applied in $\mlfn{ForwardPropagate}$ 
\[ \mu(L_k) \pia F \bor \mu(L_k) \]
Define abstract disjunction $\sqcup_D$ for this purpose, such
that
\[
F_1 \sbor F_2 \Bimplies F_1 \abor{D} F_2
\quad\mbox{and}\quad
F_1 \abor{D} F_2 \in D
\]
for $F_1,F_2 \in D$.

Unlike conjunction, exact disjunction is usually not represented in
the domain $D$.

\bigskip
{\bf Step 5: Define abstract implication checking.}

\medskip
On each iteration of the inner loop of $\mlfn{ForwardPropagate}$,
validity of the implication
\[
F \Bimplies \mu(L_k)
\]
is checked to determine whether $\mu(L_k)$ has changed.  A proper
selection of $D$ ensures that this validity check is decidable.
\end{frame}

\begin{frame}
{\bf Step 6: Define widening.}

\medskip
Defining an abstraction is not sufficient to guarantee
termination in general.  Thus, abstractions that do not guarantee termination are
equipped with a widening operator $\widen{D}$.

A \defn{widening operator} $\widen{D}$ is a binary function\\
\qquad $\widen{D}: D \times D \rightarrow D$\\
\smallskip
such that\\
\qquad $F_1 \sbor F_2 \Bimplies F_1 \widen{D} F_2$\\
\smallskip
for $F_1,F_2 \in D$.  It obeys the following property.  Let $F_1, F_2,
F_3, \ldots$ be an infinite sequence of elements $F_i \in D$ such that
for each $i$,\\
\qquad $F_i \Bimplies F_{i+1}~.$\\
\smallskip
Define the sequence\\
\qquad $G_1 = F_1
\smallskip
\quad\mbox{and}\quad
G_{i+1} = G_i \widen{D} F_{i+1}~.$\\
For some $i^*$ and for all $i \ge i^*$,\\
\qquad $G_i \Bequiv G_{i+1}~.$\\
\smallskip
That is, the sequence $G_i$ converges even if the sequence $F_i$ does
not converge.  A proper strategy of applying widening guarantees that the forward
propagation procedure terminates.


\end{frame}

\begin{frame}
\begin{figure}[tb]
\[
\begin{mlblock}
  \begin{mlfunction}{AbstractForwardPropagate}{P\ F_{\mathsf{pre}}\ \locs}
    S \mlassign \set{L_0}; \\
    \mu(L_0) \mlassign \nu_D(F_{\mathsf{pre}}); \\ 
    \mu(L) \mlassign \false\ \mlkwd{for}\ L \in \locs \setminus \set{L_0}; \\
    \begin{mlwhile}{S \ne \emptyset}
      \mlsmalllet{L_j}{\mlfn{choose}\ S} \\
      S \mlassign S \setminus \set{L_j}; \\
      \begin{mlforeach}{L_k \in \mathsf{succ}(L_j)}
	\mlsmalllet{F}{\aspost{D}{\mu(L_j)}{S_j;\ldots;S_k}} \\
	\mlif F \not\Rightarrow \mu(L_k) \\
	\mlthen \begin{mlblock}
	  \mlif \mlfn{Widen}() \\
	  \mlthen \mu(L_k) \mlassign \mu(L_k) \widen{D} (\mu(L_k) \abor{D} F); \\
	  \mlelse \mu(L_k) \mlassign \mu(L_k) \abor{D} F; \\
	  S \mlassign S \cup \set{L_k};
	\end{mlblock} \\
      \end{mlforeach}
    \end{mlwhile} \\
    \mu
  \end{mlfunction}
\end{mlblock}
\]
\end{figure}

\end{frame}


\end{document}
