6,535 research outputs found
Differentially Testing Soundness and Precision of Program Analyzers
In the last decades, numerous program analyzers have been developed both by
academia and industry. Despite their abundance however, there is currently no
systematic way of comparing the effectiveness of different analyzers on
arbitrary code. In this paper, we present the first automated technique for
differentially testing soundness and precision of program analyzers. We used
our technique to compare six mature, state-of-the art analyzers on tens of
thousands of automatically generated benchmarks. Our technique detected
soundness and precision issues in most analyzers, and we evaluated the
implications of these issues to both designers and users of program analyzers
On the Termination of Linear and Affine Programs over the Integers
The termination problem for affine programs over the integers was left open
in\cite{Braverman}. For more that a decade, it has been considered and cited as
a challenging open problem. To the best of our knowledge, we present here the
most complete response to this issue: we show that termination for affine
programs over Z is decidable under an assumption holding for almost all affine
programs, except for an extremely small class of zero Lesbegue measure. We use
the notion of asymptotically non-terminating initial variable values} (ANT, for
short) for linear loop programs over Z. Those values are directly associated to
initial variable values for which the corresponding program does not terminate.
We reduce the termination problem of linear affine programs over the integers
to the emptiness check of a specific ANT set of initial variable values. For
this class of linear or affine programs, we prove that the corresponding ANT
set is a semi-linear space and we provide a powerful computational methods
allowing the automatic generation of these sets. Moreover, we are able to
address the conditional termination problem too. In other words, by taking ANT
set complements, we obtain a precise under-approximation of the set of inputs
for which the program does terminate.Comment: arXiv admin note: substantial text overlap with arXiv:1407.455
Synthesizing Short-Circuiting Validation of Data Structure Invariants
This paper presents incremental verification-validation, a novel approach for
checking rich data structure invariants expressed as separation logic
assertions. Incremental verification-validation combines static verification of
separation properties with efficient, short-circuiting dynamic validation of
arbitrarily rich data constraints. A data structure invariant checker is an
inductive predicate in separation logic with an executable interpretation; a
short-circuiting checker is an invariant checker that stops checking whenever
it detects at run time that an assertion for some sub-structure has been fully
proven statically. At a high level, our approach does two things: it statically
proves the separation properties of data structure invariants using a static
shape analysis in a standard way but then leverages this proof in a novel
manner to synthesize short-circuiting dynamic validation of the data
properties. As a consequence, we enable dynamic validation to make up for
imprecision in sound static analysis while simultaneously leveraging the static
verification to make the remaining dynamic validation efficient. We show
empirically that short-circuiting can yield asymptotic improvements in dynamic
validation, with low overhead over no validation, even in cases where static
verification is incomplete
Inferring Loop Invariants using Postconditions
One of the obstacles in automatic program proving is to obtain suitable loop
invariants.
The invariant of a loop is a weakened form of its postcondition (the loop's
goal, also known as its contract); the present work takes advantage of this
observation by using the postcondition as the basis for invariant inference,
using various heuristics such as "uncoupling" which prove useful in many
important algorithms.
Thanks to these heuristics, the technique is able to infer invariants for a
large variety of loop examples.
We present the theory behind the technique, its implementation (freely
available for download and currently relying on Microsoft Research's Boogie
tool), and the results obtained.Comment: Slightly revised versio
LNCS
We introduce in this paper AMT 2.0 , a tool for qualitative and quantitative analysis of hybrid continuous and Boolean signals that combine numerical values and discrete events. The evaluation of the signals is based on rich temporal specifications expressed in extended Signal Temporal Logic (xSTL), which integrates Timed Regular Expressions (TRE) within Signal Temporal Logic (STL). The tool features qualitative monitoring (property satisfaction checking), trace diagnostics for explaining and justifying property violations and specification-driven measurement of quantitative features of the signal
Automatically refining partial specifications for Program Verification
10.1007/978-3-642-21437-0_28Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)6664 LNCS369-38
- …