3,892 research outputs found
Counterexample-Guided Polynomial Loop Invariant Generation by Lagrange Interpolation
We apply multivariate Lagrange interpolation to synthesize polynomial
quantitative loop invariants for probabilistic programs. We reduce the
computation of an quantitative loop invariant to solving constraints over
program variables and unknown coefficients. Lagrange interpolation allows us to
find constraints with less unknown coefficients. Counterexample-guided
refinement furthermore generates linear constraints that pinpoint the desired
quantitative invariants. We evaluate our technique by several case studies with
polynomial quantitative loop invariants in the experiments
Generating Non-Linear Interpolants by Semidefinite Programming
Interpolation-based techniques have been widely and successfully applied in
the verification of hardware and software, e.g., in bounded-model check- ing,
CEGAR, SMT, etc., whose hardest part is how to synthesize interpolants. Various
work for discovering interpolants for propositional logic, quantifier-free
fragments of first-order theories and their combinations have been proposed.
However, little work focuses on discovering polynomial interpolants in the
literature. In this paper, we provide an approach for constructing non-linear
interpolants based on semidefinite programming, and show how to apply such
results to the verification of programs by examples.Comment: 22 pages, 4 figure
A Survey of Symbolic Execution Techniques
Many security and software testing applications require checking whether
certain properties of a program hold for any possible usage scenario. For
instance, a tool for identifying software vulnerabilities may need to rule out
the existence of any backdoor to bypass a program's authentication. One
approach would be to test the program using different, possibly random inputs.
As the backdoor may only be hit for very specific program workloads, automated
exploration of the space of possible inputs is of the essence. Symbolic
execution provides an elegant solution to the problem, by systematically
exploring many possible execution paths at the same time without necessarily
requiring concrete inputs. Rather than taking on fully specified input values,
the technique abstractly represents them as symbols, resorting to constraint
solvers to construct actual instances that would cause property violations.
Symbolic execution has been incubated in dozens of tools developed over the
last four decades, leading to major practical breakthroughs in a number of
prominent software reliability applications. The goal of this survey is to
provide an overview of the main ideas, challenges, and solutions developed in
the area, distilling them for a broad audience.
The present survey has been accepted for publication at ACM Computing
Surveys. If you are considering citing this survey, we would appreciate if you
could use the following BibTeX entry: http://goo.gl/Hf5FvcComment: This is the authors pre-print copy. If you are considering citing
this survey, we would appreciate if you could use the following BibTeX entry:
http://goo.gl/Hf5Fv
Finding polynomial loop invariants for probabilistic programs
Quantitative loop invariants are an essential element in the verification of
probabilistic programs. Recently, multivariate Lagrange interpolation has been
applied to synthesizing polynomial invariants. In this paper, we propose an
alternative approach. First, we fix a polynomial template as a candidate of a
loop invariant. Using Stengle's Positivstellensatz and a transformation to a
sum-of-squares problem, we find sufficient conditions on the coefficients.
Then, we solve a semidefinite programming feasibility problem to synthesize the
loop invariants. If the semidefinite program is unfeasible, we backtrack after
increasing the degree of the template. Our approach is semi-complete in the
sense that it will always lead us to a feasible solution if one exists and
numerical errors are small. Experimental results show the efficiency of our
approach.Comment: accompanies an ATVA 2017 submissio
Invariant Synthesis for Incomplete Verification Engines
We propose a framework for synthesizing inductive invariants for incomplete
verification engines, which soundly reduce logical problems in undecidable
theories to decidable theories. Our framework is based on the counter-example
guided inductive synthesis principle (CEGIS) and allows verification engines to
communicate non-provability information to guide invariant synthesis. We show
precisely how the verification engine can compute such non-provability
information and how to build effective learning algorithms when invariants are
expressed as Boolean combinations of a fixed set of predicates. Moreover, we
evaluate our framework in two verification settings, one in which verification
engines need to handle quantified formulas and one in which verification
engines have to reason about heap properties expressed in an expressive but
undecidable separation logic. Our experiments show that our invariant synthesis
framework based on non-provability information can both effectively synthesize
inductive invariants and adequately strengthen contracts across a large suite
of programs
- …