7,039 research outputs found
Searching for invariants using genetic programming and mutation testing
Invariants are concise and useful descriptions of a program's behaviour. As most programs are not annotated with invariants, previous research has attempted to automatically generate them from source code. In this paper, we propose a new approach to invariant generation using search. We reuse the trace generation front-end of existing tool Daikon and integrate it with genetic programming and a mutation testing tool. We demonstrate that our system can find the same invariants through search that Daikon produces via template instantiation, and we also find useful invariants that Daikon does not. We then present a method of ranking invariants such that we can identify those that are most interesting, through a novel application of program mutation
Generating Property-Directed Potential Invariants By Backward Analysis
This paper addresses the issue of lemma generation in a k-induction-based
formal analysis of transition systems, in the linear real/integer arithmetic
fragment. A backward analysis, powered by quantifier elimination, is used to
output preimages of the negation of the proof objective, viewed as unauthorized
states, or gray states. Two heuristics are proposed to take advantage of this
source of information. First, a thorough exploration of the possible
partitionings of the gray state space discovers new relations between state
variables, representing potential invariants. Second, an inexact exploration
regroups and over-approximates disjoint areas of the gray state space, also to
discover new relations between state variables. k-induction is used to isolate
the invariants and check if they strengthen the proof objective. These
heuristics can be used on the first preimage of the backward exploration, and
each time a new one is output, refining the information on the gray states. In
our context of critical avionics embedded systems, we show that our approach is
able to outperform other academic or commercial tools on examples of interest
in our application field. The method is introduced and motivated through two
main examples, one of which was provided by Rockwell Collins, in a
collaborative formal verification framework.Comment: In Proceedings FTSCS 2012, arXiv:1212.657
Synthesizing Switching Controllers for Hybrid Systems by Continuous Invariant Generation
We extend a template-based approach for synthesizing switching controllers
for semi-algebraic hybrid systems, in which all expressions are polynomials.
This is achieved by combining a QE (quantifier elimination)-based method for
generating continuous invariants with a qualitative approach for predefining
templates. Our synthesis method is relatively complete with regard to a given
family of predefined templates. Using qualitative analysis, we discuss
heuristics to reduce the numbers of parameters appearing in the templates. To
avoid too much human interaction in choosing templates as well as the high
computational complexity caused by QE, we further investigate applications of
the SOS (sum-of-squares) relaxation approach and the template polyhedra
approach in continuous invariant generation, which are both well supported by
efficient numerical solvers
- …