The Automation of C Program Verification by Symbolic Method of Loop Invariants Elimination

Abstract

During deductive verification of programs written in imperative languages, the generation and proof of verification conditions corresponding to loops can cause difficulties, because each one must be provided with an invariant whose construction is often a challenge. As a rule, the methods of invariant synthesis are heuristic ones. This impedes its application. An alternative is the symbolic method of loop invariant elimination suggested by V.A. Nepomniaschy in 2005. Its idea is to represent a loop body in a form of special replacement operation under certain constraints. This operation expresses loop effect in a symbolic form and allows to introduce an inference rule which uses no invariants in axiomatic semantics. This work represents the further development of this method. It extends the mixed axiomatic semantics method suggested for C-light program verification. This extension includes the verification method of iterations over changeable arrays possibly with loop exit in C-light programs. The method contains the inference rule for iterations without loop invariants. This rule was implemented in verification conditions generator which is a part of the automated system of C-light program verification. To prove verification conditions automatically in ACL2, two algorithms were developed and implemented. The first one automatically generates the replacement operation in ACL2 language, the second one automatically generates auxiliary lemmas which allow to prove the obtained verification conditions in ACL2 successfully in automatic mode. An example which illustrates the application of the mentioned methods is described.

Towards Automated Error Localization in C Programs With Loops

“…This strategy resembles one described in [8]. Indeed, both of them use the value of loop-break field.…”

“…But differences also take place. First, this strategy is applied to any implication containing rep, whereas strategy from [8] analyses program postconditions only. Second, the latter one generates lemmas in the form of conjunction.…”

“…Since all variables in ACL2 are implicitly universally quantified, the existence quantifier appears in the negated VC. Thus, our previous strategies [8,11] fail here and we need revised ones. Another requirement the unsat strategies must work for loops with abrupt termination (i.e.…”

“…The loop execution is modeled symbolically by replacement function rep. Some results of such adaptation were discussed in [6,8].…”

“…At the moment, the main theorem prover for C-light is ACL2 [5]. The classic induction in ACL2 is not powerful enough to handle VCs with replacement function rep, so the proof strategies are proposed in [8,11].…”