Software Model Checking with Horn Clauses
Beamed by Daan Leijen's Madoko
Nikolaj Bjørner 
In collaboration with Arie Gurfinkel, Ken McMillan, Andrey Rybalchenko VTSA Summer School, 2014 nbjorner@microsoft.com 
Contents
 Horn Clauses
 Methods for solving Horn Clauses:
 Bottomup Datalog in
 Fold/Unfold
 Magic
 Infinite Descent
 Predicate Abstraction
 Interpolants
 IC3 (with interpolants)
 Yogi as Horn clause solving
Horn SAT and UNSAT
 
UNSAT  SAT 
 
Produce a  Produce an explicit model, or 
resolution proof  proof that there is no resolution proof 
 
Focus of CLP  Aim of our efforts 
 
 Claim: relative completeness:
 There is no third case, modulo completeness of assertion language.
 Claim: UNSAT is r.e. when SAT for is r.e.
 e.g., if assertion is wrong, there is a finite counterexample.
 Claim: SAT is generally not r.e.
 Bounds for finite domains given by Datalog query complexity
 Note: relative completeness does not hold for Horn+ clauses.
Transitions Horn Clauses
  program variables
  initial states
  transition relation
  safe states
Transitions Horn Clauses
Programs Horn Clauses
  program variables
  initial states of main procedure
  intraprocedural transition relation
  safe states
  parameter passing relation
  return value passing
Programs Horn Clauses
Programs Horn Clauses
 Alternative lenses:
 Define Hoare Logic, extract Horn clauses.
 Boogie does this as a sideeffect
 Define continuation passing style semantics of program
 Success and Failure continuation.
 Failure contionation feeds into assertions.
 Success continuation feeds into the next statement.
Programs Horn Clauses
Programs Horn Clauses
What about procedure calls?
Programs Horn Clauses
 Claim: Other translations exist.
 Research question: which one is most suitable?
Dealing with Loose Semantics
 Is this program safe?
l0: if (unknown(x) > 0) goto :error
 Horn clauses (attempt 1)
l0(x) < true.
error < l0(x), unknown(x) > 0.
 Possible interpretation:
unknown(x) := 0;
l0 := true;
error := false;
 This is probably not what we want.
Dealing with Loose Semantics
Proper semantics obtained by quantifying over all loose models.
which is equivalent to:
Dealing with Loose Semantics and Abduction
More generally, proper semantics is for:
When there is a canonical interpretation for background
theory (arithmetic without division), proper semantics coincides
with satisfiability modulo theories , e.g,:
Compare to constraint handling rules in logic programming.
Contents
 Methods for solving Horn Clauses:
 Bottomup Datalog in
 Fold/Unfold
 Magic
 Infinite Descent
 Predicate Abstraction
 Interpolants
 IC3 (with interpolants)
 Yogi as Horn clause solving
Bottomup Datalog in .
Bottomup Datalog in
 Clauses instructions using relational algebra.
 join
 project
 rename
 select ,
 filter
 For efficiency allow combined operations
 joinproject
 selectproject
 Implementation depends on table representation.
Network Optimized Datalog NoD

Option 1: use BDDs to represent tables.

Option 2: build tables from ternary bitvectors.

 Table is a union of differences of cubes

 Same as 01100, 01111, 00011, 00000

Option 3,4,..: Use hash tables, Btrees, bitmaps
 Work in some pointeranalysis applications, but not for header spaces
Network Optimized Datalog
Network Optimized Datalog
Network Optimized Datalog
Contents
 Methods for solving Horn Clauses:
 Bottomup Datalog in
 Fold/Unfold
 Magic
 Infinite Descent
 Predicate Abstraction
 Interpolants
 IC3 (with interpolants)
 Yogi as Horn clause solving
FoldUnfold
New Definition
Rewriting, such as rewriting equalites
FoldUnfold Analysis
 Foldunfold used in context of Prolog or CLP.
 Highly expressive assertion language.
 When does FoldUnfold terminate if is derivable?
 When is foldunfold a decision procedure?
 Boolean Horn clauses (finite domains).
 Horn clauses for simple pushdown systems?
FoldUnfold References
 [15, 43, 44] Classics
 [39] Unfold/Fold for Verification
 MAPS system, [28]
 [25] Fold/unfold + magic + polyhedra + interpolants
Contents
 Methods for solving Horn Clauses:
 Bottomup Datalog in
 Fold/Unfold
 Magic
 Infinite Descent
 Predicate Abstraction
 Interpolants
 IC3 (with interpolants)
 Yogi as Horn clause solving
What is the Magic?
 Introduced in Datalog to emulate topdown using bottomup evalution.
 Supplies constraints from calling context.
Contents
 Methods for solving Horn Clauses:
 Bottomup Datalog in
 Fold/Unfold
 Magic
 Infinite Descent
 Predicate Abstraction
 Interpolants
 IC3 (with interpolants)
 Yogi as Horn clause solving
Infinite Descent Example




[1,3, tautology]

[2,3]

[simplify 5, subsumed 3]
Infinite Descent
 Tabling in Datalog/Prolog: memoize answers [42].
 Tabling + memoize and generalize queries [12, 32, 41].
 saturation by superposition [22].
 What relationships can be made between Infinite Descent and Fold/Unfold proofs?
Contents
 Methods for solving Horn Clauses:
 Bottomup Datalog in
 Fold/Unfold
 Magic
 Infinite Descent
 Predicate Abstraction
 Interpolants
 IC3 (with interpolants)
 Yogi as Horn clause solving
Predicate Abstraction: Houdini [23]
 For each predicate
 Create set of candidate solutions
 Check each clause
 Fail if is empty.
 Succeed if fixedpoint where each clause checks.
Predicate Abstraction: Cartesian Templates [26]
 For each predicate
 Create set of candidate properties and states.
 For each clause
 Fail if query, for “” is not valid for some .
 Succeed if fixedpoint reached while maintaining infeasible query.
Contents
 Methods for solving Horn Clauses:
 Bottomup Datalog in
 Fold/Unfold
 Magic
 Infinite Descent
 Predicate Abstraction
 Interpolants
 IC3 (with interpolants)
 Yogi as Horn clause solving
Contents
 Methods for solving Horn Clauses:
 Bottomup Datalog in
 Fold/Unfold
 Magic
 Infinite Descent
 Predicate Abstraction
 Interpolants
 IC3 (with interpolants)
 Yogi as Horn clause solving
IC3 recap
  a transition system.
  good states.
  forward predicate transformer.
 Given reachable states , produce “states can be reached by including another step”.
 From Transition System:
 From Horn Clauses: , where
IC3 recap
 properties of states reachable within steps.
 are sets of clauses.
 Initially .
 a queue of counterexample trace properties. Initially .
 a level indication. Initially .
Expanding Traces
repeat until ∞
Termination
repeat until ∞

Unreachable For , if , return Unreachable.

Reachable If , return Reachable.
Search
repeat until ∞
 Decide Add to if
Backtracking
repeat until ∞