Automatic generation method of loop invariants based on postconditions

Abstract

The present invention discloses a method for automatically generating loop invariants based on postconditions. First, an initial candidate invariant is constructed according to the postcondition of a loop statement, and a verifier supporting single-layer loops and double-layer loops is designed to verify the validity of the loop invariant. Then, a program is run to generate a high-quality sample data set, the sample data is annotated using the Hall logic relationship of the loop program, and the invariant classifier is learned using the KSVM method. Finally, it is verified whether the learned invariant classifier is valid. If it is valid, it means that the generated invariant classifier is the obtained loop invariant. Otherwise, the sample data is iteratively executed and learned using a kernel support vector machine classifier to obtain a verifiable loop invariant. The present invention constructs an initial candidate invariant using a loop postcondition, and selects classification samples on the boundary of the SVM classifier constructed based on the initial loop invariant, which greatly shortens the generation time of the loop invariant and improves the successful generation rate of the verifiable loop invariant.

Description

Technical Field

[0001] The invention belongs to the technical fields of software engineering, program analysis, software security and formal verification, and relates to a method for automatically generating loop invariants. Background Art

[0002] Loop invariants are properties that a program should maintain before and after each loop execution. Writing a loop invariant for a program can help programmers deeply understand the semantics of the program, and can also detect whether the program has illegal behavior at the program breakpoint, providing an important and reliable basis for program verification. However, manually writing loop invariants is a very time-consuming and challenging task. In addition, during program verification, not all loop invariants are verifiable (such as the eternally true type). Only loop invariants that can pass program verification are verifiable invariants. Therefore, in recent years, many researchers have studied the hot research topic of automatically generating loop invariants. At present, the methods for automatically generating loop invariants can be divided into two categories: static methods and dynamic methods. When generating loop invariants with static methods, there is no need to run the loop program, and the loop invariants are obtained directly through static analysis methods. However, this method is very time-consuming and the form of the loop invariants obtained is usually relatively simple. The dynamic method calculates loop invariants by executing loop programs, which can generate loop invariants with more complex forms (for example, polynomial loop invariants). However, because it is related to the coverage of the program execution path, it is easy to generate some false loop invariants or redundant invariants. Therefore, the problem of automatically generating verifiable loop invariants using dynamic methods has attracted much attention from researchers. At present, some research results have been achieved in the related research on automatically generating loop invariants using machine learning methods, but most methods are based on linear division of randomly generated sample data, which may lead to the inability to generate loop invariants due to linear indivisibility. It is also difficult to approximate loop invariants due to the randomness of sample data, which leads to a long time to generate loop invariants. In addition, the automatic generation of loop invariants currently mainly stays in the program structure of single-layer loops, and there is little research on the automatic generation of invariants of nested loops. Summary of the invention

[0003] The problem to be solved by the present invention is to provide an automatic loop invariant generation method based on postconditions for executable loop programs. The objectives of the present invention are: first, to improve the success rate of automatically generating loop invariants, and to overcome the problem of low success rate of generating loop invariants when using machine learning to classify random sample data; second, to shorten the time required for automatically generating loop invariants, and to solve the problem that it is difficult to approach effective loop invariants due to the randomness of sample data, thereby making it take a long time to automatically generate loop invariants; third, to solve the problem of automatically generating nested loop invariants, so as to overcome the problem that existing methods cannot solve the problem of automatically generating nested loop invariants.

[0004] To this end, the method for automatically generating loop invariants based on postconditions provided by the present invention comprises the following steps:

[0005] Step 1: construct the initial candidate invariant CanInv according to the loop statement block. In the Hall logic verification rule, the postcondition is a weakened form of the loop invariant. This step uses this logical relationship to construct the candidate invariant CanInv according to the postcondition of the loop statement block.

[0006] Step 2: Construct an invariant verifier to verify whether the candidate invariant CanInv is valid. If CanInv can pass the program verification, the verifiable loop invariant Inv of the program has been generated, that is, Inv = CanInv. If CanInv cannot pass the verification, the counterexample data is obtained, added to the sample data set, and step 3 is executed.

[0007] Step 3: Generate a sample data set SD to update the candidate loop invariant CanInv that cannot pass the verification in step 2.

[0008] Step 4: label the sample data set SD generated in step 3, and use the kernel support vector machine KSVM (Kernel Support Vector Machine) method to learn a classifier for these labeled sample data sets SD;

[0009] Step 5: Update the candidate invariant CanInv using the classifier generated in step 4. If the updated candidate loop invariant CanInv fails to pass the verification, execute step 2 to perform the next cycle and iteratively update the candidate invariant CanInv.

[0010] In the above step 1, the construction of the initial candidate invariant CanInv for the loop statement block is to perform an equivalent linear transformation or polynomial inequality transformation on the postcondition to establish an initial candidate invariant. From the perspective of logic, the postcondition is a weakened form of the loop invariant. In this way, for the case where the loop invariant is a postcondition, the effective loop invariant of the loop program can be quickly obtained. Otherwise, that is, for the case where the loop invariant is not a postcondition, the effective loop invariant can be quickly obtained using a machine learning method.

[0011] In step 2, the construction of a loop invariant verifier to verify whether the candidate invariant CanInv is verifiable refers to using the program correctness verification logic rules to check whether the candidate loop invariant is a verifiable invariant to ensure the correctness of the loop invariant. The constructed invariant verifier can be used to verify the validity of single-layer loop invariants and nested loop invariants.

[0012] Among them, the candidate invariant verification of the single-layer loop is verified by contradiction, and its verification rules are as follows:

[0013]

[0014]

[0015]

[0016] The candidate invariant verification of nested loops is verified by using the constraints of each layer of loop invariants. Taking two layers of nested loops as an example, the verification rules are as follows:

[0017] P→Inv, (1)

[0018] {Inv∧C}{Body1∧Inv inn ∧Body2}{Inv} (2)

[0019]

[0020] P inn ∧Inv→Inv inn (4)

[0021] {Inv inn ∧C inn}{Body inn}{Inv inn} (5)

[0022]

[0023] Among them, P inn 、Inv inn , C inn 、Body inn , Q inn They represent the precondition, loop invariant, loop condition, loop body and postcondition of the inner loop respectively. According to the hierarchical verification rules of two-layer loops, it can be extended to the invariant verification of n-layer nested loops.

[0024] In step 2, if the candidate loop invariant cannot pass the verification, counterexample data is obtained, which means that the counterexample data of the loop invariant that cannot pass the validity verification is calculated using the solution technology of the satisfiability theory, and these counterexample data are collected as classification sample data as the basis for the next round of updating the candidate loop invariant.

[0025] In step 3, the generated sample data set SD includes (1) sample data selected on the boundary of the candidate invariant generated in step 2; (2) sample data that meets P and does not meet P according to the loop precondition P, and new sample data obtained by running the loop statement using the sample data that meets P as loop input; (3) the counter-example data generated in step 2. In this way, the collected sample data set SD contains both positive sample data and counter-example sample data, which can improve the effectiveness of the classification results of the data samples, that is, obtain a valid candidate loop invariant.

[0026] In step 4, the sample data set SD generated by the labeling refers to labeling the data set SD generated in step 3 into three categories: positive sample data, counterexample sample data and uncertain sample data according to the preconditions, postconditions and loop bodies of the program in the program verification rules.

[0027] In step 4, the kernel support vector machine KSVM method is a multi-kernel classification algorithm that supports kernel functions such as radial basis kernel functions, linear kernel functions, and Gaussian functions to solve the classification problem of complex data samples, thereby obtaining candidate loop invariants in various forms, such as loop invariants in the form of polynomials.

[0028] In step 5, the method of updating the candidate invariant CanInv using the KSVM classifier generated in step 4 is to use the KSVM classifier learned in step 4 as a new candidate invariant, and continue to return to step 2 to verify its validity to determine whether the candidate invariant is a verifiable loop invariant, thereby deciding whether the next round of solution is needed.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1. The method for automatically generating loop invariants based on postconditions provided by the present invention performs equivalent transformation on the postconditions to construct initial candidate invariants according to the logical reasoning relationship between the postconditions and the loop invariants, and can directly obtain effective loop invariants or quickly approximate loop invariants, thereby greatly shortening the automatic generation time of loop invariants.

[0031] 2. When the initial candidate invariant is not a verifiable loop invariant, the present invention selects sample data on the classifier boundary constructed by the initial candidate invariant to improve the quality of the sample data set and improve the success rate of loop invariant generation for complex non-deterministic loop programs.

[0032] 3. The present invention solves the problem of automatic generation of invariants of nested loops and provides an effective method for automatic generation of invariants of nested loops. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flowchart of generating loop invariants based on machine learning according to the present invention. DETAILED DESCRIPTION

[0034] The present invention is described in detail below with reference to the accompanying drawings.

[0035] The present invention proposes a method for automatically generating verifiable loop invariants based on postconditions. The main purposes of the method are: (1) automatically generating verifiable loop invariants with rich forms; (2) shortening the time for automatically generating loop invariants and improving the success rate of automatically generating loop invariants; and (3) solving the problem of automatically generating invariants for single-layer loops and nested loops.

[0036] The process of automatically generating loop invariants based on postconditions of the present invention is as follows: Figure 1 As shown, the specific implementation process is as follows:

[0037] In the first step, the initial candidate invariant CanInv of the loop statement block is constructed by using the postcondition of the generated loop statement and its logical reasoning relationship with the loop invariant.

[0038] The second step is to construct an invariant verifier to verify whether the candidate invariant CanInv is verifiable. The verifier can verify both single-layer loop statements and nested loop statements. The verification process is to first construct the verification rules, and then input the program to be verified and the verification rules into the SMT (Satisfiability modulo theories) solver to automatically complete the verification. Among them, the verification of the candidate invariant of the single-layer loop is carried out by contradiction, and the specific verification rules are as follows:

[0039]

[0040]

[0041]

[0042] The candidate invariant verification of nested loops is verified by using the constraints of the loop invariants at each layer, and is implemented using a hierarchical verification method. Taking two layers of nested loops as an example, the verification rules are as follows:

[0043] P→Inv, (4)

[0044] {Inv∧C}{Body1∧Inv inn ∧Body2}{Inv} (5)

[0045]

[0046] P inn∧Inv→Inv inn (7)

[0047] {Inv inn ∧C inn}{Body inn}{Inv inn} (8)

[0048]

[0049] Among them, P inn 、Inv inn , C inn 、Body inn , Q inn They represent the precondition, loop invariant, loop condition, loop body and postcondition of the inner loop respectively. According to the hierarchical verification rules of two-layer loops, it can be extended to the invariant verification of n-layer nested loops.

[0050] In the third step, the generated sample data set SD consists of three types of data: (1) sample data selected on the boundary of the candidate invariant generated in step 2; (2) sample data that satisfy P and do not satisfy P based on the loop precondition P, and new sample data obtained by running the loop statement with sample data that satisfies P as loop input; (3) counterexample data generated in step 2.

[0051] The fourth step is to label the sample data sets SD, and use the kernel support vector machine KSVM (Kernel Support Vector Machine) algorithm to classify these labeled sample data sets SD, and obtain a classifier that can be used to update the candidate loop invariant.

[0052] Step 5: Use the classifier generated in step 4 to update the candidate invariant CanInv and execute step 2.

[0053] The algorithm involved in generating loop invariants based on postconditions is now introduced.

[0054] Automatic Generation Algorithm of Loop Invariants

[0055] Input: loop precondition P, loop condition C, loop body Body and loop postcondition Q

[0056] Output: loop invariant Inv

[0057] Step 1: Perform linear transformation or polynomial equivalent transformation on the postcondition to construct the initial candidate invariant CanInv;

[0058] Step 2: Construct the variable set V involved in the loop program through the loop condition C and the loop body Body;

[0059] Step 3: Verify whether CanInv is verifiable. If it is verifiable, jump to Step 5; if it is not verifiable, collect the counterexample data generated when the loop program is executed and execute Step 4;

[0060] Step 4: Update the candidate invariant CanInv. The specific operations are as follows:

[0061] 1. Use the candidate invariant CanInv as the KSVM classifier clf;

[0062] 2. Generate sample data that meets P and does not meet P based on the variable set V and the precondition P, and add them to the sample data set SD.

[0063] 3. Based on the generated sample data, execute the loop program again, collect the sample data generated during the program running process, and add it to the sample data set SD.

[0064] 4. Add the counterexample data collected in Step 3 to the sample data set SD;

[0065] 5. Select sample data on the boundary of classifier clf and add it to the data set SD;

[0066] 6. Use the sample dataset SD to learn a new KSVM classifier, and use the learned classifier as the new candidate invariant CanInv, and jump to Step 3.

[0067] Step 5: Output the loop invariant Inv = CanInv.

[0068] In order to facilitate those skilled in the art to implement the present invention, the implementation of the present invention is now described as follows.

[0069] The method provided by the present invention can automatically generate effective loop invariants for computer programs (such as C programs) containing loop statements, requiring the program to consist of preconditions, postconditions and loop statements. When in use, if it is a loop program with branches, the automatic generation process of the loop invariant is: first, the multi-branch loop is decomposed into multiple execution paths according to the path analysis method, and then for each execution path, the loop invariant is generated respectively according to the above-mentioned method of using the kernel support vector machine, and finally the generated loop invariants are combined into a disjunction of loop invariants to obtain the invariant of the multi-branch loop program. When in use, if it is a nested loop, the inner loop statement block and the outer loop statement block are treated as independent loop statement blocks, and first the candidate loop invariant CanInv of the outer loop is generated according to the invariant generation method of the single-layer loop, and then the loop invariant CanInv of the inner loop is generated according to the invariant generation method of the single-layer loop.inn Because the inner loop must maintain the properties of the outer loop, that is, the invariant of the outer loop is also valid in the inner loop, so the candidate invariant of the inner loop is CanInv inn =CanInv inn ∧CanInv. Finally, the nested loop verification rule is used to verify whether the generated candidate loop invariant is verifiable. If it cannot pass the verification, counterexample data is generated to continue the next round of solving. If it can pass the verification, the loop invariants of each layer are calculated.

[0070] The above-described implementation methods express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it should not be understood as limiting the scope of the present invention. It should be pointed out that, for those of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these also belong to the protection scope of the present invention.

Claims

1. A method for automatically generating loop invariants based on postconditions, characterized in that: The following steps are involved: Step 1: construct the initial candidate invariant CanInv according to the loop statement block. In the Hall logic verification rule, the postcondition is a weakened form of the loop invariant. With the help of this logical relationship, the candidate invariant CanInv is constructed according to the postcondition of the loop statement block. Step 2: construct an invariant verifier to verify whether the candidate invariant CanInv is valid. If CanInv can pass the program verification, the verifiable loop invariant Inv of the program has been generated, that is, Inv = CanInv; if CanInv cannot pass the verification, obtain the counterexample data and add it to the sample data set; Construct an invariant verifier to verify whether the candidate invariant CanInv is verifiable. The verifier can verify both single-layer loop statements and nested loop statements. The verification process is to first construct verification rules, and then input the program to be verified and the verification rules into the Satisfiability modulo theories solver to automatically complete the verification. Among them, the verification of the candidate invariant of the single-layer loop is carried out by contradiction. The specific verification rules are as follows: The candidate invariant verification of nested loops is verified by using the constraints of the loop invariants at each layer, and is implemented using a hierarchical verification method. Taking two layers of nested loops as an example, the verification rules are as follows: P→Inv, (4) {Inv∧C}{Body1∧Inv inn ∧Body2}{Inv}(5) P inn ∧Inv→Inv inn (7) {Inv inn ∧C inn }{Body inn }{Inv inn }(8) Among them, P inn 、Inv inn , C inn 、Body inn , Q inn They represent the precondition, loop invariant, loop condition, loop body and postcondition of the inner loop respectively. According to the hierarchical verification rules of two-layer loops, they can be extended to the invariant verification of n-layer nested loops. Step 3: Generate a sample data set SD to update the candidate loop invariant CanInv that cannot pass the verification in step 2; The generated sample data set SD consists of three types of data: (1) sample data selected on the boundary of the candidate invariant generated in step 2; (2) sample data that satisfies P and does not satisfy P according to the loop precondition P, and new sample data obtained by running the loop statement with sample data that satisfies P as loop input; (3) counterexample data generated in step 2; Step 4: label the sample data set SD generated in step 3, and use the kernel support vector machine method to learn a classifier on these labeled sample data sets SD; Step 5: Use the classifier generated in step 4 to update the candidate invariant CanInv. If the updated candidate loop invariant CanInv fails to pass the verification, return to step 2 for the next cycle to iteratively update the candidate invariant CanInv.

2. The method for automatically generating loop invariants based on postconditions according to claim 1, characterized in that: In step 1, the initial candidate invariant CanInv is constructed for the loop statement block by utilizing the logical relationship between the postcondition and the loop invariant, performing an equivalent linear transformation or a polynomial inequality transformation on the postcondition to establish an initial candidate invariant.

3. The method for automatically generating loop invariants based on postconditions according to claim 1, characterized in that: The invariant verifier described in step 2 can be used to verify the validity of both single-layer loop invariants and nested loop invariants.

4. The method for automatically generating loop invariants based on postconditions according to claim 1, characterized in that: In step 2, obtaining counterexample data refers to using the solution technology of satisfiability theory to calculate counterexample data of loop invariants that cannot pass validity verification, and collecting these counterexample data as classification sample data as the basis for the next round of updating candidate loop invariants.

5. The method for automatically generating loop invariants based on postconditions according to claim 1, characterized in that: In step 4, the sample data set SD generated by the annotation refers to annotating the data set SD generated in step 3 into three categories: positive sample data, counterexample sample data and uncertain sample data according to the preconditions, postconditions and loop bodies of the program in the program verification rules.

6. The method for automatically generating loop invariants based on postconditions according to claim 1, characterized in that: In step five, the method of updating the candidate invariant CanInv using the KSVM classifier generated in step four is to use the KSVM classifier learned in step four as a new candidate invariant, and continue to return to step two to verify its validity to determine whether the candidate invariant is a verifiable loop invariant, thereby deciding whether the next round of solution is needed.

Images