A Modular Static Analysis Approach to Affine Loop Invariants Detection

Abstract

International audienceModular static analyzers use procedure abstractions, a.k.a. summarizations, to ensure that their execution time increases linearly with the size of analyzed programs. A similar abstraction mechanism is also used within a procedure to perform a bottom-up analysis. For instance, a sequence of instructions is abstracted by combining the abstractions of its components, or a loop is abstracted using the abstraction of its loop body: fixed point iterations for a loop can be replaced by a direct computation of the transitive closure of the loop body abstraction. More specifically, our abstraction mechanism uses affine constraints, i.e. polyhedra, to specify pre- and post-conditions as well as state transformers. We present an algorithm to compute the transitive closure of such a state transformer, and we illustrate its performance on various examples. Our algorithm is simple, based on discrete differentiation and integration: it is very different from the usual abstract interpretation fixed point computation based on widening. Experiments are carried out using previously published examples. We obtain the same results directly, without using any heuristic

Model Checking Embedded C Software Using k-Induction and Invariants

“…Previous work on the one hand have explored proofs by mathematical induction of hardware and software systems with some limitations, e.g., requiring changes in the code to introduce loop invariants [6], [9]. This complicates the automation of the verification process, unless other methods are used in combination to automatically compute the loop invariant [20], [21]. Similar to the approach proposed by [22], [7], our method is completely automatic and does not require the user to provide loops invariants as the final assertions after each loop.…”

Using Basis Dependence Distance Vectors to Calculate the Transitive Closure of Dependence Relations by Means of the Floyd-Warshall Algorithm

“…Numerous algorithms for calculating the transitive closure of affine integer tuple relations have been proposed [1,2,6,7,9,11,13]. However, in most of them authors focus on relations whose domain and range are non-parametric polyhedra [1,7,9].…”

“…However, in most of them authors focus on relations whose domain and range are non-parametric polyhedra [1,7,9]. The second limitation of known algorithms is that they require that the arity of input and output tuples (the number of tuple elements) of relations has to be the same [2].…”

Tutorial on Static Inference of Numeric Invariants by Abstract Interpretation

“…Most additional control structures found in actual languages do not pose much challenge: they can be handled either on a control-flow graph level, or through an encoding into continuations. Functions may require additional abstractions: while it is possible to inline function calls, provided that the call stack is bounded, this is not always efficient enough; a more scalable approach to, possibly unbounded, function calls (including the case of recursive functions) would employ a more modular approach [Ancourt et al, 2010].…”