## Speed: Precise and efficient static estimation of program computational complexity (2009)

### Cached

### Download Links

- [research.microsoft.com]
- [www.research.microsoft.com]
- [www.research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [www.research.microsoft.com]
- [www.research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [research.microsoft.com]
- DBLP

### Other Repositories/Bibliography

Venue: | In POPL’09 |

Citations: | 47 - 5 self |

### BibTeX

@INPROCEEDINGS{Gulwani09speed:precise,

author = {Sumit Gulwani and Krishna K. Mehra and Trishul Chilimbi},

title = {Speed: Precise and efficient static estimation of program computational complexity},

booktitle = {In POPL’09},

year = {2009}

}

### OpenURL

### Abstract

This paper describes an inter-procedural technique for computing symbolic bounds on the number of statements a procedure executes in terms of its scalar inputs and user-defined quantitative functions of input data-structures. Such computational complexity bounds for even simple programs are usually disjunctive, non-linear, and involve numerical properties of heaps. We address the challenges of generating these bounds using two novel ideas. We introduce a proof methodology based on multiple counter instrumentation (each counter can be initialized and incremented at potentially multiple program locations) that allows a given linear invariant generation tool to compute linear bounds individually on these counter variables. The bounds on these counters are then composed together to generate total bounds that are non-linear and disjunctive. We also give an algorithm for automating this proof

### Citations

616 | Automatic Discovery of Linear Restraints among Variables of a Program - Cousot, Halbwachs - 1978 |

148 | Termination Proofs for Systems Code
- Cook
- 2006
(Show Context)
Citation Context ...and Examples SimpleMultiple and SimpleMultipleDep in Figure 4. The termination argument for each of these examples (as provided by termination techniques based on disjunctively well-founded relations =-=[26, 6, 1]-=-) is the same: between any two successive (not necessarily consecutive) loop iterations either x increases and is bounded above by n, or y increases and is bounded above by m. This implies a total bou... |

147 | Static prediction of heap space usage for first-order functional programs
- Hofmann, Jost
- 2003
(Show Context)
Citation Context ...he programmer. In contrast, our technique infers bounds. Hofmann and Jost statically infer linear bounds on heap space usage of firstorder functional programs running under a special memory mechanism =-=[19]-=-. They use linear typing and an inference method through linear programming to derive these bounds. Their linear programming technique requires no fix-point analysis but it restricts the memory effect... |

133 | Object invariants in dynamic contexts
- Leino, Müller
- 2004
(Show Context)
Citation Context ...n order to appropriately update TotalNodes(L) in such cases, we propose introducing a function Owner that maps e to its top-level list L. This idea is borrowed from the literature on ownership fields =-=[21]-=-. • Owner(e): Top-level list L to which the nested list e belongs. (If e is not a nested list, then Owner(()e) is don’t care.) Table (a) in Figure 7 describes the updates to these functions by some li... |

127 | Cssv: towards a realistic tool for statically detecting all buffer overflows in c
- Dor, Rodeh, et al.
- 2003
(Show Context)
Citation Context ...l-complexity bounds. Reducing pointers to integer programs Our notion of quantitative functions is related to recent work on reducing (primarily singly linked list-based) pointers to integer programs =-=[10, 3, 22]-=- after conducting alias analysis in a prepass. In comparison, our approach is limited in two ways. It applies only to abstract datatypes, and aliasing has to be taken care of by the uninterpreted func... |

121 | Resource bound certification
- Crary, Weirich
- 2000
(Show Context)
Citation Context ...ype system targeted towards reasoning about complexity of programs in lazy functional languages [9]. Crary and Weirich presented a type system for reasoning about resource consumption, including time =-=[8]-=-. Hughes and Pareto proposed a type and effect system on space usage estimation based on the notion of sized types for a variant of ML such that well typed programs are proven to execute within the gi... |

117 | Verification of realtime systems using linear relation analysis
- Halbwachs, Proy, et al.
- 1997
(Show Context)
Citation Context ...er, it analyzes single-path executions of programs (i.e., using input data corresponding to one execution). Hence, their bounds are in real seconds, while our bounds are symbolic functions of inputs. =-=[17]-=- determines loop bounds in synchronous programs and linear hybrid systems by using a relational linear analysis to compute linear bounds on the delay or timer variables of the system. In contrast, our... |

96 | Transition Invariants
- Podelski
- 2004
(Show Context)
Citation Context ...and Examples SimpleMultiple and SimpleMultipleDep in Figure 4. The termination argument for each of these examples (as provided by termination techniques based on disjunctively well-founded relations =-=[26, 6, 1]-=-) is the same: between any two successive (not necessarily consecutive) loop iterations either x increases and is bounded above by n, or y increases and is bounded above by m. This implies a total bou... |

84 | Recursion and Dynamic Data-Structures in Bounded Space; Towards Embedded ML Programming
- Hughes, Pareto
- 1999
(Show Context)
Citation Context ...o proposed a type and effect system on space usage estimation based on the notion of sized types for a variant of ML such that well typed programs are proven to execute within the given memory bounds =-=[21]-=-. In these approaches, no effort is made to infer any bounds; instead they provide a mechanism for certifying the bounds once they are provided by the programmer. In contrast, our technique infers bou... |

81 | Automatic Complexity Analysis
- Rosendahl
- 1989
(Show Context)
Citation Context ... to produce a bound are specific to a programming practice. Rosendahl describes a system to compute complexity bounds of programs written in a first-order subset of LISP using abstract interpretation =-=[27]-=-. His system outputs a time-bound program that is not guaranteed to be in closed form. In addition, the technique only works for programs where recursion is controlled by structural constraints, such ... |

61 | Programs with lists are counter automata
- Bouajjani, Bozga, et al.
- 2006
(Show Context)
Citation Context ...l-complexity bounds. Reducing pointers to integer programs Our notion of quantitative functions is related to recent work on reducing (primarily singly linked list-based) pointers to integer programs =-=[10, 3, 22]-=- after conducting alias analysis in a prepass. In comparison, our approach is limited in two ways. It applies only to abstract datatypes, and aliasing has to be taken care of by the uninterpreted func... |

43 | Variance analyses from invariance analyses
- Berdine, Chawdhary, et al.
- 2007
(Show Context)
Citation Context ...and Examples SimpleMultiple and SimpleMultipleDep in Figure 4. The termination argument for each of these examples (as provided by termination techniques based on disjunctively well-founded relations =-=[26, 6, 1]-=-) is the same: between any two successive (not necessarily consecutive) loop iterations either x increases and is bounded above by n, or y increases and is bounded above by m. This implies a total bou... |

42 | Arithmetic strengthening for shape analysis
- Magill, Berdine, et al.
- 2007
(Show Context)
Citation Context ...l-complexity bounds. Reducing pointers to integer programs Our notion of quantitative functions is related to recent work on reducing (primarily singly linked list-based) pointers to integer programs =-=[10, 3, 22]-=- after conducting alias analysis in a prepass. In comparison, our approach is limited in two ways. It applies only to abstract datatypes, and aliasing has to be taken care of by the uninterpreted func... |

41 | The polyranking principle
- Bradley, Manna, et al.
- 2005
(Show Context)
Citation Context ...ns provides a free termination argument and may even yield a simpler and more efficient alternative to termination strategies pursued in [1, 6], which rely on synthesizing ranking functions for loops =-=[26, 5, 4]-=-. We start with a brief description of our overall methodology along with some examples in Section 2. 2. Overall Methodology The basic idea of our methodology is to instrument monitor variables (hence... |

41 | Engelen. Supporting timing analysis by automatic bounding of loop iterations
- Healy, Sjödin, et al.
- 2000
(Show Context)
Citation Context ...ral features such as caches, branch prediction, instruction pipelines. For establishing loop bounds, WCET techniques either require user annotation, or use simple techniques based on pattern matching =-=[18]-=- or some simple numerical analysis. [16] describes an interval analysis based approach for automatic computation of loop bounds. However, it analyzes single-path executions of programs (i.e., using in... |

38 |
Combining abstract interpreters
- Gulwani, Tiwari
- 2006
(Show Context)
Citation Context ...have described a general mechanism for combining the transfer functions of two given abstract interpreters to generate an abstract interpreter than can discover invariants over combination of domains =-=[15]-=-. We can use this methodology to combine an abstract interpreter for linear arithmetic (such as the one based on polyhedron domain [7]) with an abstract interpreter for uninterpreted functions [14]. W... |

34 | Automatic derivation of loop bounds and infeasible paths for WCET analysis using abstract execution
- Gustafsson, Ermedahl, et al.
- 2006
(Show Context)
Citation Context ...iction, instruction pipelines. For establishing loop bounds, WCET techniques either require user annotation, or use simple techniques based on pattern matching [18] or some simple numerical analysis. =-=[16]-=- describes an interval analysis based approach for automatic computation of loop bounds. However, it analyzes single-path executions of programs (i.e., using input data corresponding to one execution)... |

31 | Invariant synthesis for combined theories
- Beyer, Henzinger, et al.
- 2007
(Show Context)
Citation Context ...bed how to extend constraint-based techniques for generating numerical invariants to synthesis of invariants expressible in the combined theory of linear arithmetic and uninterpreted function symbols =-=[2]-=-. Unlike fixed-point computation based techniques like abstract interpretation, constraint-based 3 Aliasing is required to reason whether an update to an uninterpreted function such as Len(L1) can aff... |

29 | User-Definable Resource Bounds Analysis for Logic Programs
- Navas, Mera, et al.
- 2007
(Show Context)
Citation Context ...putes symbolic bounds by curve-fitting timing data obtained from profiling. Their technique has the advantage of measuring real amortized complexity; however the results are not sound for all inputs. =-=[24]-=- presents a formalism for user-defined resources on which bounds can be computed in terms of input data sizes. In contrast, we focus on computational-complexity bounds and present a formalism for user... |

28 | Termination analysis of integer linear loops
- Bradley, Manna, et al.
- 2005
(Show Context)
Citation Context ...ns provides a free termination argument and may even yield a simpler and more efficient alternative to termination strategies pursued in [1, 6], which rely on synthesizing ranking functions for loops =-=[26, 5, 4]-=-. We start with a brief description of our overall methodology along with some examples in Section 2. 2. Overall Methodology The basic idea of our methodology is to instrument monitor variables (hence... |

26 | A polynomial-time algorithm for global value numbering
- Gulwani, Necula
(Show Context)
Citation Context ...ns [15]. We can use this methodology to combine an abstract interpreter for linear arithmetic (such as the one based on polyhedron domain [7]) with an abstract interpreter for uninterpreted functions =-=[14]-=-. We have implemented our invariant generation tool using this methodology. • Constraint-based invariant generation technique. Beyer et al. have described how to extend constraint-based techniques for... |

24 |
A combination framework for tracking partition sizes
- Gulwani, Lev-Ami, et al.
- 2009
(Show Context)
Citation Context ...ility to ensure that the user has conservatively estimated the effect of different methods over the quantitative attributes of different objects with respect to the intended semantics. (A recent work =-=[13]-=- can be used to check the soundness of the user specifications w.r.t. the intended semantics, if the intended semantics can be described as the size of some partition in an appropriate logic.) We carr... |

19 | Measuring empirical computational complexity
- GOLDSMITH, AIKEN, et al.
(Show Context)
Citation Context ...aranteed to be in closed form. In addition, the technique only works for programs where recursion is controlled by structural constraints, such as length of a list due to limitations of the analysis. =-=[11]-=- computes symbolic bounds by curve-fitting timing data obtained from profiling. Their technique has the advantage of measuring real amortized complexity; however the results are not sound for all inpu... |

18 |
The Determination of Worst-Case Execution Times—Overview of the Methods and Survey of Tools. accepted for
- Wilhelm, Engblom, et al.
- 2007
(Show Context)
Citation Context ...nd non-linear) for imperative programs. Worst-case Execution Time Analysis There is a large body of work on estimating worst case execution time (WCET) in the embedded and real-time systems community =-=[28, 29]-=-. The WCET research is more orthogonally focused on distinguishing between the complexity of different code-paths and low-level modeling of architectural features such as caches, branch prediction, in... |

15 | A numerical abstract domain based on expression abstraction and max operator with application in timing analysis
- Gulavani, Gulwani
- 2008
(Show Context)
Citation Context ...r technique can generate more precise timing bounds. Symbolic Bound Generation Gulavani and Gulwani have described the design of a rich numerical domain to generate non-linear disjunctive invariants =-=[12]-=-, and they have applied it to generating bounds for timing analysis. However, their system requires the user to describe the set of important expressions (over which the linear relationships are to be... |

11 |
Lightweight semiformal time complexity analysis for purely functional data structures
- Danielsson
- 2008
(Show Context)
Citation Context ... that touches hot data-structures. 8. Related Work Type System Based Approaches Danielsson presented a type system targeted towards reasoning about complexity of programs in lazy functional languages =-=[9]-=-. Crary and Weirich presented a type system for reasoning about resource consumption, including time [8]. Hughes and Pareto proposed a type and effect system on space usage estimation based on the not... |

6 |
Ace: An Automatic Complexity Evaluator
- Métayer
- 1988
(Show Context)
Citation Context ... better used as an instance of invariant generation tool within our framework (after extension with uninterpreted functions). ACE analyzes a functional language FP to derive a timecomplexity function =-=[23]-=- by repeatedly applying a large library of rewrite rules to transform the step-counting version of the original recursive program into a non-recursive bound function. However, bound generation is very... |

6 | Abstract interpretation with applications to timing validation
- Wilhelm, Wachter
- 2008
(Show Context)
Citation Context ...nd non-linear) for imperative programs. Worst-case Execution Time Analysis There is a large body of work on estimating worst case execution time (WCET) in the embedded and real-time systems community =-=[28, 29]-=-. The WCET research is more orthogonally focused on distinguishing between the complexity of different code-paths and low-level modeling of architectural features such as caches, branch prediction, in... |