2,009 research outputs found
Generating Non-Linear Interpolants by Semidefinite Programming
Interpolation-based techniques have been widely and successfully applied in
the verification of hardware and software, e.g., in bounded-model check- ing,
CEGAR, SMT, etc., whose hardest part is how to synthesize interpolants. Various
work for discovering interpolants for propositional logic, quantifier-free
fragments of first-order theories and their combinations have been proposed.
However, little work focuses on discovering polynomial interpolants in the
literature. In this paper, we provide an approach for constructing non-linear
interpolants based on semidefinite programming, and show how to apply such
results to the verification of programs by examples.Comment: 22 pages, 4 figure
Automated Generation of Non-Linear Loop Invariants Utilizing Hypergeometric Sequences
Analyzing and reasoning about safety properties of software systems becomes
an especially challenging task for programs with complex flow and, in
particular, with loops or recursion. For such programs one needs additional
information, for example in the form of loop invariants, expressing properties
to hold at intermediate program points. In this paper we study program loops
with non-trivial arithmetic, implementing addition and multiplication among
numeric program variables. We present a new approach for automatically
generating all polynomial invariants of a class of such programs. Our approach
turns programs into linear ordinary recurrence equations and computes closed
form solutions of these equations. These closed forms express the most precise
inductive property, and hence invariant. We apply Gr\"obner basis computation
to obtain a basis of the polynomial invariant ideal, yielding thus a finite
representation of all polynomial invariants. Our work significantly extends the
class of so-called P-solvable loops by handling multiplication with the loop
counter variable. We implemented our method in the Mathematica package Aligator
and showcase the practical use of our approach.Comment: A revised version of this paper is published in the proceedings of
ISSAC 201
Transfer Function Synthesis without Quantifier Elimination
Traditionally, transfer functions have been designed manually for each
operation in a program, instruction by instruction. In such a setting, a
transfer function describes the semantics of a single instruction, detailing
how a given abstract input state is mapped to an abstract output state. The net
effect of a sequence of instructions, a basic block, can then be calculated by
composing the transfer functions of the constituent instructions. However,
precision can be improved by applying a single transfer function that captures
the semantics of the block as a whole. Since blocks are program-dependent, this
approach necessitates automation. There has thus been growing interest in
computing transfer functions automatically, most notably using techniques based
on quantifier elimination. Although conceptually elegant, quantifier
elimination inevitably induces a computational bottleneck, which limits the
applicability of these methods to small blocks. This paper contributes a method
for calculating transfer functions that finesses quantifier elimination
altogether, and can thus be seen as a response to this problem. The
practicality of the method is demonstrated by generating transfer functions for
input and output states that are described by linear template constraints,
which include intervals and octagons.Comment: 37 pages, extended version of ESOP 2011 pape
Polynomial Invariants for Affine Programs
We exhibit an algorithm to compute the strongest polynomial (or algebraic)
invariants that hold at each location of a given affine program (i.e., a
program having only non-deterministic (as opposed to conditional) branching and
all of whose assignments are given by affine expressions). Our main tool is an
algebraic result of independent interest: given a finite set of rational square
matrices of the same dimension, we show how to compute the Zariski closure of
the semigroup that they generate
Automating Program Verification and Repair Using Invariant Analysis and Test Input Generation
Software bugs are a persistent feature of daily life---crashing web browsers, allowing cyberattacks, and distorting the results of scientific computations. One approach to improving software uses program invariants---mathematical descriptions of program behaviors---to verify code and detect bugs. Current invariant generation techniques lack support for complex yet important forms of invariants, such as general polynomial relations and properties of arrays. As a result, we lack the ability to conduct precise analysis of programs that use this common data structure. This dissertation presents DIG, a static and dynamic analysis framework for discovering several useful classes of program invariants, including (i) nonlinear polynomial relations, which are fundamental to many scientific applications; disjunctive invariants, (ii) which express branching behaviors in programs; and (iii) properties about multidimensional arrays, which appear in many practical applications. We describe theoretical and empirical results showing that DIG can efficiently and accurately find many important invariants in real-world uses, e.g., polynomial properties in numerical algorithms and array relations in a full AES encryption implementation. Automatic program verification and synthesis are long-standing problems in computer science. However, there has been a lot of work on program verification and less so on program synthesis. Consequently, important synthesis tasks, e.g., generating program repairs, remain difficult and time-consuming. This dissertation proves that certain formulations of verification and synthesis are equivalent, allowing for direct applications of techniques and tools between these two research areas. Based on these ideas, we develop CETI, a tool that leverages existing verification techniques and tools for automatic program repair. Experimental results show that CETI can have higher success rates than many other standard program repair methods
Invariant Generation for Multi-Path Loops with Polynomial Assignments
Program analysis requires the generation of program properties expressing
conditions to hold at intermediate program locations. When it comes to programs
with loops, these properties are typically expressed as loop invariants. In
this paper we study a class of multi-path program loops with numeric variables,
in particular nested loops with conditionals, where assignments to program
variables are polynomial expressions over program variables. We call this class
of loops extended P-solvable and introduce an algorithm for generating all
polynomial invariants of such loops. By an iterative procedure employing
Gr\"obner basis computation, our approach computes the polynomial ideal of the
polynomial invariants of each program path and combines these ideals
sequentially until a fixed point is reached. This fixed point represents the
polynomial ideal of all polynomial invariants of the given extended P-solvable
loop. We prove termination of our method and show that the maximal number of
iterations for reaching the fixed point depends linearly on the number of
program variables and the number of inner loops. In particular, for a loop with
m program variables and r conditional branches we prove an upper bound of m*r
iterations. We implemented our approach in the Aligator software package.
Furthermore, we evaluated it on 18 programs with polynomial arithmetic and
compared it to existing methods in invariant generation. The results show the
efficiency of our approach
- …