[Paper Review] Compositional Safety Verification with Max-SMT

Marc Brockschmidt, Daniel Larraz+3 more|RECERCAT (Consorci de Serveis Universitaris de Catalunya)|Jul 14, 2015

Formal Methods in Verification22 references6 citations

TL;DR

This paper presents a compositional safety verification framework using Max-SMT to synthesize conditional inductive invariants that serve as preconditions ensuring program safety. By iteratively refining failed proofs through a novel narrowing technique and propagating preconditions bottom-up, the method enables scalable, precise, and distributable verification of sequential programs, outperforming existing tools on numerical benchmarks with improved speed and proof coverage.

ABSTRACT

We present an automated compositional program verification technique for safety properties based on conditional inductive invariants. For a given program part (e.g., a single loop) and a postcondition $φ$, we show how to, using a Max-SMT solver, an inductive invariant together with a precondition can be synthesized so that the precondition ensures the validity of the invariant and that the invariant implies $φ$. From this, we build a bottom-up program verification framework that propagates preconditions of small program parts as postconditions for preceding program parts. The method recovers from failures to prove the validity of a precondition, using the obtained intermediate results to restrict the search space for further proof attempts. As only small program parts need to be handled at a time, our method is scalable and distributable. The derived conditions can be viewed as implicit contracts between different parts of the program, and thus enable an incremental program analysis.

Motivation & Objective

• To address the scalability and precision challenges in automated program verification for large-scale software systems.
• To enable compositional reasoning by synthesizing relevant intermediate assertions (conditional invariants) that are both sound and useful for proof composition.
• To recover from failed proof attempts by using intermediate results to guide refinement, reducing search space and improving convergence.
• To support incremental and distributable analysis by propagating preconditions as postconditions across program components.
• To develop a practical, scalable verification framework that outperforms existing tools on numerical and sequential programs.

Proposed method

• Uses Max-SMT solvers to simultaneously handle hard constraints (soundness) and soft constraints (usefulness) in synthesizing conditional inductive invariants.
• Applies a novel narrowing transformation to focus on missing proof components when a precondition fails to hold, guiding iterative refinement.
• Employs a bottom-up analysis strategy that treats the postcondition of a program part as the precondition for its predecessor, enabling incremental verification.
• Introduces memoization of failed proof attempts to avoid redundant search and accelerate convergence in iterative refinement.
• Supports parallel execution by distributing invariant synthesis tasks across program components, with performance gains observed on multi-core systems.
• Uses inlining for procedure calls and plans to extend support to recursive functions via template-based pre/postcondition synthesis.

Experimental results

Research questions

• RQ1 How can we automatically synthesize precise, compositional invariants that are both sound and useful for proving safety properties?
• RQ2 How can we recover from failed proof attempts in a way that reduces search space and accelerates convergence?
• RQ3 Can Max-SMT solving be effectively used to balance soundness and usefulness in invariant synthesis for sequential programs?
• RQ4 How does the compositional, bottom-up verification framework scale and perform compared to existing tools on realistic benchmarks?
• RQ5 What is the impact of parallelization and memoization on the performance and completeness of the verification process?

Key findings

• On the HOLA-BENCHS benchmark set, VeryMax-Par achieved 45 verified safety properties, outperforming CPAchecker (33), SeaHorn (32), and HOLA (43), with a total runtime of 151.21 seconds.
• On the larger NR-BENCHS set of 6,452 numerical safety problems, VeryMax-Par verified 6,106 out of 6,452 assertions, surpassing all compared tools in proof coverage.
• The parallel version of VeryMax was approximately two times faster than the sequential version on four cores, demonstrating effective parallelization.
• The sequential version of VeryMax required an average of 2.8 recursive or narrowed proof attempts per problem, with a maximum of 16, indicating moderate iteration overhead.
• Memoization of failed proof attempts was applied in about one-third of cases, showing effective reuse of intermediate results to avoid redundant computation.
• VeryMax-Par achieved a total runtime of 23,668.15 seconds on NR-BENCHS, significantly faster than CPAchecker (735,336.82 seconds), while solving more problems.