## Control-flow refinement and progress invariants for bound analysis (2009)

### Cached

### Download Links

Venue: | In PLDI |

Citations: | 24 - 5 self |

### BibTeX

@INPROCEEDINGS{Gulwani09control-flowrefinement,

author = {Sumit Gulwani and Sagar Jain and Eric Koskinen},

title = {Control-flow refinement and progress invariants for bound analysis},

booktitle = {In PLDI},

year = {2009}

}

### OpenURL

### Abstract

Symbolic complexity bounds help programmers understand the performance characteristics of their implementations. Existing work provides techniques for statically determining bounds of procedures with simple control-flow. However, procedures with nested loops or multiple paths through a single loop are challenging. In this paper we describe two techniques, control-flow refinement and progress invariants, that together enable estimation of precise bounds for procedures with nested and multi-path loops. Control-flow refinement transforms a multi-path loop into a semantically equivalent code fragment with simpler loops by making the structure of path interleaving explicit. We show that this enables non-disjunctive invariant generation tools to find a bound on many procedures for which previous techniques were unable to prove termination. Progress invariants characterize relationships between

### Citations

572 | Automatic discovery of linear restraints among variables of a program
- Cousot, Halbwachs
- 1978
(Show Context)
Citation Context ...e invariant tmp ≤ maxId; hence path ρ2 is infeasible at the start of Lines 8, and 6. These invariants are easily computed by several standard (conjunctive, pathinsensitive) linear relational analyses =-=[22, 7]-=-. The simplification used to obtain Figure 1(d) from Figure 1(c) may not always be possible after one expansion, but may require repeated expansion of multi-path loops. This raises the issue of termin... |

232 | The Octagon Abstract Domain
- Miné
(Show Context)
Citation Context ...e invariant tmp ≤ maxId; hence path ρ2 is infeasible at the start of Lines 8, and 6. These invariants are easily computed by several standard (conjunctive, pathinsensitive) linear relational analyses =-=[22, 7]-=-. The simplification used to obtain Figure 1(d) from Figure 1(c) may not always be possible after one expansion, but may require repeated expansion of multi-path loops. This raises the issue of termin... |

134 | Termination Proofs for Systems Code
- Cook, Podelski, et al.
- 2006
(Show Context)
Citation Context ...ts, yet would fail to compute a bound because the invariants required are path-sensitive. In fact, we do not know of any technique that can even prove termination of this procedure. Recent techniques =-=[6, 5]-=- based on disjunctively well-founded ranking functions [24] fail for this example because there does not exist a disjunctively wellfounded linear ranking function. The mildly complex control flow in t... |

116 | Resource Bound Certification
- Crary, Weirich
- 2000
(Show Context)
Citation Context ... bounds by curve-fitting timing data obtained from profiling. Their technique has the advantage of measuring real amortized complexity; however the results are not sound for all inputs. Crary Weirich =-=[8]-=- presents a type system for certifying (as opposed to inferring) resource consumption, including time. 10. Conclusion and Future Work We have introduced novel techniques for automatically determining ... |

112 |
A complete method for the synthesis of linear ranking functions
- Podelski, Rybalchenko
- 2004
(Show Context)
Citation Context ...en any two successive states in a loop. These abstractions are given by the progress invariants INITD and NEXTD described in Section 5. The output is both 3 This name follows the spirit of RankFinder =-=[23]-=-, which accomplishes a similar task of finding a ranking function for a transition invariant.B(s) = (1, ∅) (1) where s ∈ {skip, x:=e,assume(c)} B(s1; s2) = (c1 + c2, Z1 ∪ Z2) (2) where (c1, Z1) = B(s... |

108 | Verification of real-time systems using linear relation analysis
- Halbwachs, Proy, et al.
- 1997
(Show Context)
Citation Context ...lculating a bound on the number of iterations of a given loop. Two kinds of techniques have been proposed for automatically bounding loop iterations: pattern matching [18] and counter instrumentation =-=[17, 12, 15]-=-. Unfortunately, these techniques have limitations: (i) They compute bounds for simple loops that have a single path (a straight-line sequence of statements) or a set of paths with similar effect, but... |

93 |
Ranjit Jhala, Rupak Majumdar, and Grégoire Sutre. Lazy abstraction
- Henzinger
- 2002
(Show Context)
Citation Context ...This transformation has applications beyond bound analysis, and briefly discuss one such application on proving non-trivial safety properties of procedures that otherwise require specialized analyses =-=[13, 19, 14, 10, 17]-=- (Section 8). 2. We define progress invariants, which describe relationships between a state at a program location and the previous state at the same location, and show how to compute them. Progress i... |

92 |
Synergy: a new algorithm for property checking, in
- Gulavani, Henzinger, et al.
(Show Context)
Citation Context ...This transformation has applications beyond bound analysis, and briefly discuss one such application on proving non-trivial safety properties of procedures that otherwise require specialized analyses =-=[13, 19, 14, 10, 17]-=- (Section 8). 2. We define progress invariants, which describe relationships between a state at a program location and the previous state at the same location, and show how to compute them. Progress i... |

89 | Transition Invariants
- Podelski, Rybalchenko
- 2004
(Show Context)
Citation Context ...ified and instrumented with extra variables that copy the program state at appropriate locations. We observe that progress invariants are more precise than the related notion of transition invariants =-=[24]-=- or variance analyses [5] (recently described in literature for proving termination), which describe relationships between a state at a program location and any other previous state at that location. ... |

37 | Variance analyses from invariance analyses
- Berdine, Chawdhary, et al.
- 2007
(Show Context)
Citation Context ...h extra variables that copy the program state at appropriate locations. We observe that progress invariants are more precise than the related notion of transition invariants [24] or variance analyses =-=[5]-=- (recently described in literature for proving termination), which describe relationships between a state at a program location and any other previous state at that location. Transition invariants can... |

36 | Fully Automatic, Parametric Worst‐Case Execution Time Analysis
- Lisper
(Show Context)
Citation Context ...elational linear analysis to compute linear bounds on the delay or timer variables of the system [17], interval analysis basedapproach [16], and symbolic computation of integer points in a polyhedra =-=[20]-=-). These WCET techniques cannot compute precise bounds for the examples considered in this paper. Goldsmith et al. [9] compute symbolic bounds by curve-fitting timing data obtained from profiling. The... |

34 | Automatic Inference of Upper Bounds for Recurrence Relations in Cost Analysis
- Albert, Arenas, et al.
- 2008
(Show Context)
Citation Context ...tatements including procedure calls. However, in order to obtain an interprocedural computation complexity, we can compute the cost for a procedure call x := P(y) using the following standard process =-=[15, 3]-=-. We replace the formal inputs of procedure P by actuals y in the bound expression BOUND(P), and then translate this to a bound only in terms of the inputs of the enclosing procedure by using the inva... |

34 | Engelen. Supporting Timing Analysis by Automatic Bounding of Loop Iterations
- Healy, Sjödin, et al.
(Show Context)
Citation Context ...computing complexity bounds is calculating a bound on the number of iterations of a given loop. Two kinds of techniques have been proposed for automatically bounding loop iterations: pattern matching =-=[18]-=- and counter instrumentation [17, 12, 15]. Unfortunately, these techniques have limitations: (i) They compute bounds for simple loops that have a single path (a straight-line sequence of statements) o... |

33 | Reps. Lookahead widening
- Gopan, Thomas
- 2006
(Show Context)
Citation Context ...This transformation has applications beyond bound analysis, and briefly discuss one such application on proving non-trivial safety properties of procedures that otherwise require specialized analyses =-=[13, 19, 14, 10, 17]-=- (Section 8). 2. We define progress invariants, which describe relationships between a state at a program location and the previous state at the same location, and show how to compute them. Progress i... |

29 | Static Analysis in Disjunctive Numerical Domains
- Sankaranarayanan, Ivanic, et al.
- 2006
(Show Context)
Citation Context ...se program analysis given an underlying invariant generation tool. This includes widening strategies (such as “look-ahead widening” [10] and “upto widening” [17]) or disjunctive extensions of domains =-=[13, 25, 11, 14]-=-. The primary goal of these techniques is to compute precise invariants at different program points in the original program, while we instead focus on creating a precise expansion of the program into ... |

26 |
Automatic Derivation of Loop Bounds and Infeasible Paths for WCET Analysis Using Abstract Execution
- Gustafsson, Ermedahl, et al.
- 2006
(Show Context)
Citation Context ...sed on pattern matching [18] or some numerical analysis (e.g., relational linear analysis to compute linear bounds on the delay or timer variables of the system [17], interval analysis basedapproach =-=[16]-=-, and symbolic computation of integer points in a polyhedra [20]). These WCET techniques cannot compute precise bounds for the examples considered in this paper. Goldsmith et al. [9] compute symbolic ... |

17 | Guided static analysis
- Gopan, Reps
- 2007
(Show Context)
Citation Context ...se program analysis given an underlying invariant generation tool. This includes widening strategies (such as “look-ahead widening” [10] and “upto widening” [17]) or disjunctive extensions of domains =-=[13, 25, 11, 14]-=-. The primary goal of these techniques is to compute precise invariants at different program points in the original program, while we instead focus on creating a precise expansion of the program into ... |

16 | Measuring Empirical Computational Complexity
- Goldsmith, Aiken, et al.
- 2007
(Show Context)
Citation Context ...s basedapproach [16], and symbolic computation of integer points in a polyhedra [20]). These WCET techniques cannot compute precise bounds for the examples considered in this paper. Goldsmith et al. =-=[9]-=- compute symbolic bounds by curve-fitting timing data obtained from profiling. Their technique has the advantage of measuring real amortized complexity; however the results are not sound for all input... |

13 |
The Determination of Worst-Case Execution Times—Overview of the Methods and Survey of Tools. accepted for
- Wilhelm, Engblom, et al.
- 2007
(Show Context)
Citation Context ...each loop. Furthermore, the technique only applies to arithmetic programs. There is a large body of work on estimating worst case execution time (WCET) in the embedded and real-time systems community =-=[27]-=-. The WCET research is largely orthogonal, focused on distinguishing between the complexity of different code-paths and low-level modeling of architectural features such as caches, branch prediction, ... |

10 | SLR: PathSensitive Analysis through Infeasible-Path Detection and Syntactic Language Refinement. springer verlag
- Balakrishnan, S
- 2008
(Show Context)
Citation Context ... focuses on interleavings between different paths, as opposed to what happens in different iterations of the same path. Part of our algorithm is based on pruning infeasible paths. Balakrishnan et al. =-=[4]-=- present a technique for finding infeasible paths with backward and forward analyses. Infeasible paths are removed from the transition system (“static language refinement”). The fundamental distinctio... |

8 | Using counterexamples for improving the precision of reachability computation with polyhedra
- Wang, Yang, et al.
- 2007
(Show Context)
Citation Context ...ples requires disjunctive loop invariants. Figure 10 also shows the resulting (semantically equivalent) procedure after control-flow refinement is applied using either the octagonal [22] or polyhedra =-=[26]-=- analysis as the invariant generation tool. The safety assertions in all these procedures can now be validated by running either the octagonal or the polyhedra analysis on the control-refined procedur... |

5 |
Trishul Chilimbi. SPEED: precise and efficient static estimation of program computational complexity
- Gulwani, Mehra
- 2009
(Show Context)
Citation Context ...lculating a bound on the number of iterations of a given loop. Two kinds of techniques have been proposed for automatically bounding loop iterations: pattern matching [18] and counter instrumentation =-=[17, 12, 15]-=-. Unfortunately, these techniques have limitations: (i) They compute bounds for simple loops that have a single path (a straight-line sequence of statements) or a set of paths with similar effect, but... |

3 |
Gulavani and Sumit Gulwani. A Numerical Abstract Domain Based on Expression Abstraction and Max Operator with Application in Timing Analysis
- Bhargav
- 2008
(Show Context)
Citation Context ...lculating a bound on the number of iterations of a given loop. Two kinds of techniques have been proposed for automatically bounding loop iterations: pattern matching [18] and counter instrumentation =-=[17, 12, 15]-=-. Unfortunately, these techniques have limitations: (i) They compute bounds for simple loops that have a single path (a straight-line sequence of statements) or a set of paths with similar effect, but... |

3 |
Reflexive transitive loop invariants: A basis for computing loop functions
- Mili
- 2007
(Show Context)
Citation Context ... based on disjunctive extensions (each of which is unique w.r.t. the number of disjuncts, and their merging). Progress Invariants Our notion of progress invariants is related to transition invariants =-=[24, 6, 21]-=- or variance analyses [5] (recently described in literature for proving termination), which describe relationships between a state at a program location and any other (as opposed to immediately) previ... |