Results 1 
8 of
8
A numerical abstract domain based on expression abstraction and max operator with application in timing analysis
 In CAV
, 2008
"... Abstract. This paper describes a precise numerical abstract domain for use in timing analysis. The numerical abstract domain is parameterized by a linear abstract domain and is constructed by means of two domain lifting operations. One domain lifting operation is based on the principle of expression ..."
Abstract

Cited by 14 (4 self)
 Add to MetaCart
Abstract. This paper describes a precise numerical abstract domain for use in timing analysis. The numerical abstract domain is parameterized by a linear abstract domain and is constructed by means of two domain lifting operations. One domain lifting operation is based on the principle of expression abstraction (which involves defining a set of expressions and specifying their semantics using a collection of directed inference rules) and has a more general applicability. It lifts any given abstract domain to include reasoning about a given set of expressions whose semantics is abstracted using a set of axioms. The other domain lifting operation domain via introduction of max expressions. We present experimental results demonstrating the potential of the new numerical abstract domain to discover a wide variety of timing bounds (including polynomial, disjunctive, logarithmic, exponential, etc.) for small C programs. 1
A.V.: A data driven approach for algebraic loop invariants
, 2012
"... Abstract. We describe a GuessandCheck algorithm for computing algebraic equation invariants of the form ∧ifi(x1,..., xn) = 0, where each fi is a polynomial over the variables x1,..., xn of the program. The “guess ” phase is data driven and derives a candidate invariant from data generated from co ..."
Abstract

Cited by 4 (3 self)
 Add to MetaCart
Abstract. We describe a GuessandCheck algorithm for computing algebraic equation invariants of the form ∧ifi(x1,..., xn) = 0, where each fi is a polynomial over the variables x1,..., xn of the program. The “guess ” phase is data driven and derives a candidate invariant from data generated from concrete executions of the program. This candidate invariant is subsequently validated in a “check ” phase by an offtheshelf SMT solver. Iterating between the two phases leads to a sound algorithm. Moreover, we are able to prove a bound on the number of decision procedure queries which GuessandCheck requires to obtain a sound invariant. We show how GuessandCheck can be extended to generate arbitrary boolean combinations of linear equalities as invariants, which enables us to generate expressive invariants to be consumed by tools that cannot handle nonlinear arithmetic. We have evaluated our technique on a number of benchmark programs from recent papers on invariant generation. Our results are encouraging – we are able to efficiently compute algebraic invariants in all cases, with only a few tests.
Verification as Learning Geometric Concepts
"... Abstract. We formalize the problem of program verification as a learning problem, showing that invariants in program verification can be regarded as geometric concepts in machine learning. Safety properties define bad states: states a program should not reach. Program verification explains why a pro ..."
Abstract

Cited by 1 (1 self)
 Add to MetaCart
Abstract. We formalize the problem of program verification as a learning problem, showing that invariants in program verification can be regarded as geometric concepts in machine learning. Safety properties define bad states: states a program should not reach. Program verification explains why a program’s set of reachable states is disjoint from the set of bad states. In Hoare Logic, these explanations are predicates that form inductive assertions. Using samples for reachable and bad states and by applying well known machine learning algorithms for classification, we are able to generate inductive assertions. By relaxing the search for an exact proof to classifiers, we obtain complexity theoretic improvements. Further, we extend the learning algorithm to obtain a sound procedure that can generate proofs containing invariants that are arbitrary boolean combinations of polynomial inequalities. We have evaluated our approach on a number of challenging benchmarks and the results are promising.
CEA, LIST and LIX, Ecole Polytechnique (MeASI),
"... Coupling policy iteration with semidefinite relaxation to compute accurate numerical invariants in static analysis ..."
Abstract
 Add to MetaCart
Coupling policy iteration with semidefinite relaxation to compute accurate numerical invariants in static analysis
ViewAugmented Abstractions
, 2010
"... This paper introduces viewaugmented abstractions, which specialize an underlying numeric domain to focus on a particular expression or set of expressions. A viewaugmented abstraction adds a set of materialized views to the original domain. View augmentation can extend a domain so that it captures ..."
Abstract
 Add to MetaCart
This paper introduces viewaugmented abstractions, which specialize an underlying numeric domain to focus on a particular expression or set of expressions. A viewaugmented abstraction adds a set of materialized views to the original domain. View augmentation can extend a domain so that it captures information unavailable in the original domain. We show how to use finite differencing to maintain a materialized view in response to a transformation of the program state. Our experiments show that view augmentation can increase precision in useful ways.
The APRON library for Numerical . . .
"... The APRON library is dedicated to the static analysis of the numerical variables of a program by Abstract Interpretation [1]. The aim of such an analysis is to infer invariants about the values of numerical variables, like “at control point k, variables x, y and z satisfy the property 1 ≤ x + y ≤ z” ..."
Abstract
 Add to MetaCart
The APRON library is dedicated to the static analysis of the numerical variables of a program by Abstract Interpretation [1]. The aim of such an analysis is to infer invariants about the values of numerical variables, like “at control point k, variables x, y and z satisfy the property 1 ≤ x + y ≤ z”. In this context, the APRON library provides a common interface to various libraries implementing numerical abstract domains.
ChangeOfBases Abstractions for NonLinear Systems.
, 2012
"... We present abstraction techniques that transform a given nonlinear dynamical system into a linear system or an algebraic system described by polynomials of bounded degree, such that, invariant properties of the resulting abstraction can be used to infer invariants for the original system. The abstr ..."
Abstract
 Add to MetaCart
We present abstraction techniques that transform a given nonlinear dynamical system into a linear system or an algebraic system described by polynomials of bounded degree, such that, invariant properties of the resulting abstraction can be used to infer invariants for the original system. The abstraction techniques rely on a changeofbasis transformation that associates each state variable of the abstract system with a function involving the state variables of the original system. We present conditions under which a given change of basis transformation for a nonlinear system can define an abstraction. Furthermore, the techniques developed here apply to continuous systems defined by Ordinary Differential Equations (ODEs), discrete systems defined by transition systems and hybrid systems that combine continuous as well as discrete subsystems. The techniques presented here allow us to discover, given a nonlinear system, if a change of bases transformation involving degreebounded polynomials yielding an algebraic abstraction exists. If so, our technique yields the resulting abstract system, as well. This approach is further extended to search for a change of bases transformation that abstracts a given nonlinear system into a system of linear differential inclusions. Our techniques enable the use of analysis techniques for linear systems to infer invariants for nonlinear systems. We present preliminary evidence of the practical feasibility of our ideas using a prototype implementation. 1
unknown title
"... h = 0. 0 1; while ( true) { [ 2] w = v; v = v∗(1−h)−h∗x; x = x+h∗w; [ 3] } {x 2 ≤ 3.5000, v 2 ≤ 2.3333, 2x 2 + 3v 2 + 2xv ≤ 7} Figure 1: Euler integration scheme of a harmonic oscillator and the loop invariant found at control point 2 To illustrate the interest of this generalization, let us cons ..."
Abstract
 Add to MetaCart
h = 0. 0 1; while ( true) { [ 2] w = v; v = v∗(1−h)−h∗x; x = x+h∗w; [ 3] } {x 2 ≤ 3.5000, v 2 ≤ 2.3333, 2x 2 + 3v 2 + 2xv ≤ 7} Figure 1: Euler integration scheme of a harmonic oscillator and the loop invariant found at control point 2 To illustrate the interest of this generalization, let us consider a harmonic oscillator: ¨x + c ˙x + x = 0. By taking an explicit Euler scheme, and for c = 1 we get the program shown at the left of Figure 1. The invariant found with our method is shown right of Figure 1. For this, we have considered the template based on functions {x2, v2, 2x2 + 3v2 + 2xv}, i.e. we consider a domain where we are looking for upper bounds of these quantities. This means that we consider the nonlinear quadratic homogeneous templates based on {x2, v2}, i.e. symmetric intervals for each variable of the program, together with the nonlinear template 2x2 +