183,873 research outputs found
Improving Strategies via SMT Solving
We consider the problem of computing numerical invariants of programs by
abstract interpretation. Our method eschews two traditional sources of
imprecision: (i) the use of widening operators for enforcing convergence within
a finite number of iterations (ii) the use of merge operations (often, convex
hulls) at the merge points of the control flow graph. It instead computes the
least inductive invariant expressible in the domain at a restricted set of
program points, and analyzes the rest of the code en bloc. We emphasize that we
compute this inductive invariant precisely. For that we extend the strategy
improvement algorithm of [Gawlitza and Seidl, 2007]. If we applied their method
directly, we would have to solve an exponentially sized system of abstract
semantic equations, resulting in memory exhaustion. Instead, we keep the system
implicit and discover strategy improvements using SAT modulo real linear
arithmetic (SMT). For evaluating strategies we use linear programming. Our
algorithm has low polynomial space complexity and performs for contrived
examples in the worst case exponentially many strategy improvement steps; this
is unsurprising, since we show that the associated abstract reachability
problem is Pi-p-2-complete
Fixpoint Games on Continuous Lattices
Many analysis and verifications tasks, such as static program analyses and
model-checking for temporal logics reduce to the solution of systems of
equations over suitable lattices. Inspired by recent work on lattice-theoretic
progress measures, we develop a game-theoretical approach to the solution of
systems of monotone equations over lattices, where for each single equation
either the least or greatest solution is taken. A simple parity game, referred
to as fixpoint game, is defined that provides a correct and complete
characterisation of the solution of equation systems over continuous lattices,
a quite general class of lattices widely used in semantics. For powerset
lattices the fixpoint game is intimately connected with classical parity games
for -calculus model-checking, whose solution can exploit as a key tool
Jurdzi\'nski's small progress measures. We show how the notion of progress
measure can be naturally generalised to fixpoint games over continuous lattices
and we prove the existence of small progress measures. Our results lead to a
constructive formulation of progress measures as (least) fixpoints. We refine
this characterisation by introducing the notion of selection that allows one to
constrain the plays in the parity game, enabling an effective (and possibly
efficient) solution of the game, and thus of the associated verification
problem. We also propose a logic for specifying the moves of the existential
player that can be used to systematically derive simplified equations for
efficiently computing progress measures. We discuss potential applications to
the model-checking of latticed -calculi and to the solution of fixpoint
equations systems over the reals
- …