Results 1  10
of
20
Automatically Generating Loop Invariants Using Quantifier Elimination
 APPLICATIONS OF COMPUTER ALGEBRA (ACA2004)
, 2004
"... An approach for automatically generating loop invariants using quantifierelimination is proposed. An invariant of a loop is hypothesized as a parameterized formula. Parameters in the invariant are discovered by generating constraints on the parameters by ensuring that the formula is indeed preser ..."
Abstract

Cited by 41 (5 self)
 Add to MetaCart
(Show Context)
An approach for automatically generating loop invariants using quantifierelimination is proposed. An invariant of a loop is hypothesized as a parameterized formula. Parameters in the invariant are discovered by generating constraints on the parameters by ensuring that the formula is indeed preserved by the execution path corresponding to every basic cycle of the loop. The parameterized formula can be successively refined by considering execution paths one by one; heuristics can be developed for determining the order in which the paths are considered. Initialization of program variables as well as the precondition and postcondition of the loop, if available, can also be used to further refine the hypothesized invariant. Constraints on parameters generated in this way are solved for possible values of parameters. If no solution is possible, this means that an invariant of the hypothesized form does not exist for the loop. Otherwise, if the parametric constraints are solvable, then under certain conditions on methods for generating these constraints, the strongest possible invariant of the hypothesized form can be generated from most general solutions of the parametric constraints. The approach is illustrated using the firstorder theory of polynomial equations as well as Presburger arithmetic.
Generating All Polynomial Invariants in Simple Loops
, 2007
"... This paper presents a method for automatically generating all polynomial invariants in simple loops. It is rst shown that the set of polynomials serving as loop invariants has the algebraic structure of an ideal. Based on this connection, a xpoint procedure using operations on ideals and Grobner bas ..."
Abstract

Cited by 24 (2 self)
 Add to MetaCart
This paper presents a method for automatically generating all polynomial invariants in simple loops. It is rst shown that the set of polynomials serving as loop invariants has the algebraic structure of an ideal. Based on this connection, a xpoint procedure using operations on ideals and Grobner basis constructions is proposed for nding all polynomial invariants. Most importantly, it is proved that the procedure terminates in at most m + 1 iterations, where m is the number of program variables. The proof relies on showing that the irreducible components of the varieties associated with the ideals generated by the procedure either remain the same or increase their dimension at every iteration of the xpoint procedure. This yields a correct and complete algorithm for inferring conjunctions of polynomial equalities as invariants. The method has been implemented in Maple using the Groebner package. The implementation has been used to automatically discover nontrivial invariants for several examples to illustrate the power of the technique.
Generating Polynomial Invariants for Hybrid Systems
, 2005
"... We present a powerful computational method for automatically generating polynomial invariants of hybrid systems with linear continuous dynamics. When restricted to linear continuous dynamical systems, our method generates a set of polynomial equations (algebraic set) that is the best such overappro ..."
Abstract

Cited by 18 (1 self)
 Add to MetaCart
(Show Context)
We present a powerful computational method for automatically generating polynomial invariants of hybrid systems with linear continuous dynamics. When restricted to linear continuous dynamical systems, our method generates a set of polynomial equations (algebraic set) that is the best such overapproximation of the reach set. This shows that the set of algebraic invariants of a linear system is computable. The extension to hybrid systems is achieved using the abstract interpretation framework over the lattice defined by algebraic sets. Algebraic sets are represented using canonical Gröbner bases and the lattice operations are effectively computed via appropriate Gr"obner basis manipulations.
Automatic Generation of Polynomial Invariants of Bounded Degree using Abstract Interpretation
, 2006
"... A method for generating polynomial invariants of imperative programs is presented using the abstract interpretation framework. It is shown that for programs with polynomial assignments, an invariant consisting of a conjunction of polynomial equalities can be automatically generated for each program ..."
Abstract

Cited by 15 (1 self)
 Add to MetaCart
A method for generating polynomial invariants of imperative programs is presented using the abstract interpretation framework. It is shown that for programs with polynomial assignments, an invariant consisting of a conjunction of polynomial equalities can be automatically generated for each program point. The proposed approach takes into account tests in conditional statements as well as in loops, insofar as they can be abstracted into polynomial equalities and disequalities. The semantics of each program statement is given as a transformation on polynomial ideals. Merging of execution paths is defined as the intersection of the polynomial ideals associated with each path. For loop junctions, a family of widening operators based on selecting polynomials up to a certain degree is proposed. The presented method has been implemented and successfully tried on many programs. Heuristics employed in the implementation to improve its efficiency are discussed, and tables providing details about its performance are included.
Generation of basic semialgebraic invariants using convex polyhedra
 Static Analysis: Proceedings of the 12th [CC77] International Symposium, volume 3672 of LNCS
"... Abstract. A technique for generating invariant polynomial inequalities of bounded degree is presented using the abstract interpretation framework. It is based on overapproximating basic semialgebraic sets, i.e., sets dened by conjunctions of polynomial inequalities, by means of convex polyhedra. ..."
Abstract

Cited by 12 (0 self)
 Add to MetaCart
(Show Context)
Abstract. A technique for generating invariant polynomial inequalities of bounded degree is presented using the abstract interpretation framework. It is based on overapproximating basic semialgebraic sets, i.e., sets dened by conjunctions of polynomial inequalities, by means of convex polyhedra. While improving on the existing methods for generating invariant polynomial equalities, since polynomial inequalities are allowed in the guards of the transition system, the approach does not suer from the prohibitive complexity of methods based on quantierelimination. The application of our implementation to benchmark programs shows that the method produces nontrivial invariants in reasonable time. In some cases the generated invariants are essential to verify safety properties that cannot be proved with just classical linear invariants. 1
Logical interpretation: Static program analysis using theorem proving
 IN: CADE21. VOLUME 4603 OF LNAI., SPRINGERVERLAG
, 2007
"... This paper presents the foundations for using automated deduction technology in static program analysis. The central principle is the use of logical lattices – a class of lattices defined on logical formulas in a logical theory – in an abstract interpretation framework. Abstract interpretation over ..."
Abstract

Cited by 11 (0 self)
 Add to MetaCart
(Show Context)
This paper presents the foundations for using automated deduction technology in static program analysis. The central principle is the use of logical lattices – a class of lattices defined on logical formulas in a logical theory – in an abstract interpretation framework. Abstract interpretation over logical lattices, called logical interpretation, raises new challenges for theorem proving. We present an overview of some of the existing results in the field of logical interpretation and outline some requirements for building expressive and scalable logical interpreters.
Interprocedurally analyzing polynomial identities
 IN PROC. OF STACS 2006
, 2006
"... Since programming languages are Turing complete, it is impossible to decide for all programs whether a given nontrivial semantic property is valid or not. The wayout chosen by abstract interpretation is to provide approximate methods which may fail to certify a program property on some programs. ..."
Abstract

Cited by 11 (1 self)
 Add to MetaCart
(Show Context)
Since programming languages are Turing complete, it is impossible to decide for all programs whether a given nontrivial semantic property is valid or not. The wayout chosen by abstract interpretation is to provide approximate methods which may fail to certify a program property on some programs. Precision of the analysis can be measured by providing classes of programs for which the analysis is complete, i.e., decides the property in question. Here, we consider analyses of polynomial identities between integer variables such as x1 · x2 − 2x3 = 0. We describe current approaches and clarify their completeness properties. We also present an extension of our approach based on weakest precondition computations to programs with procedures and equality guards.
Transfer Function Synthesis without Quantifier Elimination
"... Abstract. Recently it has been shown how transfer functions for linear template constraints can be derived for bitvector programs by operating over propositional Boolean formulae. The drawback of this method is that it relies on existential quantifier elimination, which induces a computational bott ..."
Abstract

Cited by 10 (3 self)
 Add to MetaCart
(Show Context)
Abstract. Recently it has been shown how transfer functions for linear template constraints can be derived for bitvector programs by operating over propositional Boolean formulae. The drawback of this method is that it relies on existential quantifier elimination, which induces a computational bottleneck. The contribution of this paper is a novel method for synthesising transfer functions that does not rely on quantifier elimination. We demonstrate the practicality of the method for generating transfer functions for both intervals and octagons. 1
Customised induction rules for proving correctness of imperative programs
, 2004
"... This thesis is aimed at simplifying the userinteraction in semiinteractive theorem proving for imperative programs. More specifically, we describe the creation of customised induction rules that are tailormade for the specific program to verify and thus make the resulting proof simpler. The conce ..."
Abstract

Cited by 9 (1 self)
 Add to MetaCart
(Show Context)
This thesis is aimed at simplifying the userinteraction in semiinteractive theorem proving for imperative programs. More specifically, we describe the creation of customised induction rules that are tailormade for the specific program to verify and thus make the resulting proof simpler. The concern is in user interaction, rather than in proof strength. To achieve this, two different verification techniques are used. In the first approach, we develop an idea where a software testing technique, partition analysis, is used to compute a partition of the domain of the induction variable, based on the branch predicates in the program we wish to prove correct. Based on this partition we derive mechanically a partitioned induction rule, which then inherits the divideandconquer style of partition analysis, and (hopefully) is easier to use than the standard (Peano) induction rule. The second part of the thesis continues with a more thorough development of the method. Here the connection to software testing is completely removed
Join algorithms for the theory of uninterpreted functions
 IN 24TH CONFERENCE ON FOUNDATIONS OF SOFTWARE TECHNOLOGY AND THEORETICAL COMPUTER SCIENCE (FSTTCS
, 2004
"... ..."