Loop Analysis by Quantification over Iterations

Abstract

We present a framework to analyze and verify programs containing loops by using a first-order language of so-called extended expressions. This language can express both functional and temporal properties of loops. We prove soundness and completeness of our framework and use our approach to automate the tasks of partial correctness verification, termination analysis and invariant generation. For doing so, we express the loop semantics as a set of first-order properties over extended expressions and use theorem provers and/or SMT solvers to reason about these properties. Our approach supports full first-order reasoning, including proving program properties with alternation of quantifiers. Our work is implemented in the tool QuIt and successfully evaluated on benchmarks coming from software verification.

On Invariant Synthesis for Parametric Systems

“…The methods used in [KV09b, KV09a, HKV10] and also in [GKR18] often introduce a new argument to constants and functions symbols. If a(f ) is n, then an n + 1-ary version of f is used; f (x 1 , .…”

“…, x n ) at iteration i. A major difference between our approach and the methods for invariant generation used in [KV09b, KV09a, HKV10] and [GKR18] is that we do not use additional indices to refer to the values of variables at iteration steps and do not quantify over the iteration steps. However, an extension with quantification over iteration steps and possibilities of giving explicit solutions to at least simple types of recurrences seems to be feasible.…”

“…Applications to invariant generation (briefly mentioned in [KV09b]) are explored in detail in, among others, [KV09a,HKV10] -there Vampire is used to generate a large set of invariants using symbol elimination; only invariants not implied by the theory axioms or by other invariants are kept (some of these tasks are undecidable). In [GKR18], Gleiss et al analyze functional and temporal properties of loops. For this, extended expressions (introduced in [KV09a]) are used; symbol eliminationà la [KV09b] is used to synthesize invariants using quantification over iterations.…”

Verifying Relational Properties using Trace Logic

“…Program analysis by first-order reasoning is also studied in [24], where program semantics is expressed in extensions of Hoare Logic with explicit timepoints. Unlike [24], we do not rely on an intermediate program (Hoare) logic, but reason also about relational properties. While [24] can only handle simple loops, our work supports a standard while-language with explicit locations and arbitrary nestings of statements.…”

“…Unlike [24], we do not rely on an intermediate program (Hoare) logic, but reason also about relational properties. While [24] can only handle simple loops, our work supports a standard while-language with explicit locations and arbitrary nestings of statements.…”