Finding Loop Invariants for Programs over Arrays Using a Theorem Prover

Abstract

EXTENDED ABSTRACTInvariants with quantifiers are important for verification and static analysis of programs over arrays due to the unbounded nature of arrays. Such invariants can express relationships among array elements and properties involving array and scalar variables of the loop.This talk presents how quantified loop invariants of programs over arrays can be automatically inferred using a first order theorem prover, reducing the burden of annotating loops with complete invariants. Unlike all previously known methods, our method is able to generate loop invariants containing quantifier alternations.The method is based on the following steps. (1) Given a loop over array and scalar variables, we first try to extract from it various information that can be expressed by first-order formulas. For example, these formulas can express the values of loop variables in terms of the loop counter, monotonicity properties of these variables considered as functions of the loop counter and polynomial relations among these variables. For extracting this information we deploy techniques from symbolic computation, such as recurrence solving and quantifier elimination, as presented in [3], [1], to perform inductive reasoning over scalar variables.(2) Using the derived loop properties, we then automatically discover first-order properties of the so-called update predicates for array variables used in the loop and monotonicity properties for scalar variables. The update predicates describe the positions at which arrays are updated, iterations at which the updates occur and the update values. The first-order information extracted from the loop description can use auxiliary symbols, such as symbols denoting update predicates or loop counters. By relying on the update predicates of arrays and the monotonicity properties of scalars, we avoid inductive reasoning over arrays.(3) After having collected the first-order information, we run a saturation theorem prover to eliminate the auxiliary symbols and obtain loop invariants expressed as first-order formulas. In our work we used the first-order theorem prover Vampire [4]. To make Vampire suitable for invariant generation we had to extend it in two ways: (i) add a sound but incomplete axiomatisation of linear integer arithmetic that is sufficient for proving many essential properties of integers, and (ii) use a reduction ordering that makes all auxiliary symbols large in precedence and having a large weight in the Knuth-Bendix ordering used by Vampire. When the invariants derived by Vampire contain skolem functions, we de-skolemise them into formulas with quantifier alternations. The main features of our technique are the following.• We require no user guidance such as a postcondition or a collection of predicates from which an invariant can be built: all we have is a loop description. • We avoid inductive reasoning over the array content. • We are able to generate automatically complex invariants involving quantifier alternations. We have successfully tried our method on a number of ex...

Automatically inferring loop invariants via algorithmic learning

“…More precise approximations of ι and ι will improve the performance by reducing the number of iterations via increasing the number of resolvable queries. Also, a variety of techniques from static analysis or loop invariant generation (Flanagan and Qadeer 2002;Gulwani et al 2009;Gulwani et al 2008b;Gupta and Rybalchenko 2009;Kovács and Voronkov 2009;Lahiri et al 2004;McMillan 2008) in particular can be integrated to resolve queries in addition to one SMT solver with coin tossing. Such a set of multiple teachers will increase the number of resolvable queries because it suffices to have just one teacher to answer the query to proceed.…”

A parametric segmentation functor for fully automatic and scalable array content analysis

“…Theorem prover-based The method of Kovács and Voronkov [23] uses a saturation theorem prover to generate loop invariants. The idea is to encode the changes to an array at the i-th iteration as a quantified fact and then to systematically apply resolution to derive a closed form (one not mentioning the loop iteration i).…”

Precise reasoning for programs using containers

“…To find a more useful invariant store than the trivial Striv, it is necessary to infer numeric invariants relating index variables associated with different containers or allocation sites. Since the focus of this paper is not invariant generation, we do not go into the details of how to find a "good" invariant store; various techniques based on abstract interpretation [3,4] and quantifier elimination [1,5] can be used for finding invariants. In particular, our previous work on array analysis [1] presents an algorithmic way of finding such invariants in this domain, and we use the algorithm from [1] in our implementation.…”