An iterative approach to precondition inference using constrained Horn clauses

TL;DR

This paper introduces an iterative specialisation algorithm for more precise precondition inference in program verification, leveraging constrained Horn clauses and transformations like constraint specialisation and partial evaluation.

Contribution

It develops a novel iterative specialisation approach that enhances the precision of precondition inference using constrained Horn clauses and multiple transformations.

Findings

The method produces more precise safety conditions than previous approaches.

Implementation shows improved results on benchmark programs.

The approach can sometimes compute optimal safety conditions.

Abstract

We present a method for automatic inference of conditions on the initial states of a program that guarantee that the safety assertions in the program are not violated. Constrained Horn clauses (CHCs) are used to model the program and assertions in a uniform way, and we use standard abstract interpretations to derive an over-approximation of the set of unsafe initial states. The precondition then is the constraint corresponding to the complement of that set, under-approximating the set of safe initial states. This idea of complementation is not new, but previous attempts to exploit it have suffered from the loss of precision. Here we develop an iterative specialisation algorithm to give more precise, and in some cases optimal safety conditions. The algorithm combines existing transformations, namely constraint specialisation, partial evaluation and a trace elimination transformation. The last two of these transformations perform polyvariant specialisation, leading to disjunctive constraints which improve precision. The algorithm is implemented and tested on a benchmark suite of programs from the literature in precondition inference and software verification competitions.