Geometric Quantifier Elimination Heuristics for Automatically Generating Octagonal and Max-plus Invariants

Abstract

Geometric heuristics for the quantifier elimination approach presented by Kapur (2004) are investigated to automatically derive loop invariants expressing weakly relational numerical properties (such as l ≤ x ≤ h or l ≤ \pm x \pm y ≤q h) for imperative programs. Such properties have been successfully used to analyze commercial software consisting of hundreds of thousands of lines of code (using for example, the Astrée tool based on abstract interpretation framework proposed by Cousot and his group). The main attraction of the proposed approach is its much lower complexity in contrast to the abstract interpretation approach (O(n^2) in contrast to O(n^4), where n is the number of variables) with the ability to still generate invariants of comparable strength. This approach has been generalized to consider disjunctive invariants of the similar form, expressed using maximum function (such as \max(x+a,y+b,z+c,d) ≤ \max(x+e,y+f,z+g,h)), thus enabling automatic generation of a subclass of disjunctive invariants for imperative programs as well

Using dynamic analysis to generate disjunctive invariants

“…The recent static analysis work of Kapur et al [26] uses quantifier elimination to find max invariants over pairs of variables. Their method uses table look-ups to modify max relations based on the program structures (e.g., to determine how the max relation is changed after an assignment a = a + 10).…”

Speeding up the Constraint-Based Method in Difference Logic

“…Two closely related works are [21] and [22], in which invariants of slightly more general classes than difference logic are generated following the constraintbased method, but with different strategies for producing the constraints over template unknowns. In [21], the authors discover octagonal invariants, i.e., of the form ±x 1 ± x 2 ≤ k, as well as max-plus invariants max 1≤i≤n (a 0 , x i + a i ) ≤ max 1≤i≤n (b 0 , x i + b i ).…”

“…In [21], the authors discover octagonal invariants, i.e., of the form ±x 1 ± x 2 ≤ k, as well as max-plus invariants max 1≤i≤n (a 0 , x i + a i ) ≤ max 1≤i≤n (b 0 , x i + b i ). While our approach cannot currently produce max-plus invariants, the standard technique of adding for each variable x a copy standing for −x [16,23] allows generating octagonal invariants too.…”

“…While our approach cannot currently produce max-plus invariants, the standard technique of adding for each variable x a copy standing for −x [16,23] allows generating octagonal invariants too. However, the quantifier elimination method in [21] is incomplete and, as a result, invariants may be missed. Moreover, program assignments must be of the form x := ±x + K or x := K, where K is a constant, and so unlike with our techniques the common case of assignments like x := y, where x, y are different variables, is not allowed.…”

On Interpolation in Automated Theorem Proving

“…It was also suggested to let the theorem prover generate formulae from formulae specifying the loop, and take as candidate invariants those that only use the desired subset of symbols [40,45]. In approaches based on quantifier elimination, the symbols to be eliminated are quantified, so that quantifier elimination expunges them (e.g., [43,44]). An early lead towards this application can be traced back to [17].…”