Program analysis as constraint solving

Abstract

A constraint-based approach to invariant generation in programs translates a program into constraints that are solved using off-theshelf constraint solvers to yield desired program invariants.In this paper we show how the constraint-based approach can be used to model a wide spectrum of program analyses in an expressive domain containing disjunctions and conjunctions of linear inequalities. In particular, we show how to model the problem of context-sensitive interprocedural program verification. We also present the first constraint-based approach to weakest precondition and strongest postcondition inference. The constraints we generate are boolean combinations of quadratic inequalities over integer variables. We reduce these constraints to SAT formulae using bitvector modeling and use off-the-shelf SAT solvers to solve them.Furthermore, we present interesting applications of the above analyses, namely bounds analysis and generation of most-general counter-examples for both safety and termination properties. We also present encouraging preliminary experimental results demonstrating the feasibility of our technique on a variety of challenging examples.

Verification as Learning Geometric Concepts

“…Similar to us, Clousot [41] improves its performance by conjoining equalities and inequalities over boxes. Some approaches like [25,26,52,32,34,29,43] can handle disjunctions, but they restrict the number of disjunctions by widening, manual input, or trace based heuristics. In contrast, [28] handles disjunctions of a specific form.…”

Constraint-Based Invariant Inference over Predicate Abstraction

“…Constraint-based techniques have been recently used for discovering linear arithmetic invariants (conjunctive invariants [11][12][13][14] as well as disjunctive invariants [15] in the context of verifying safety properties as well as discovering ranking functions for proving termination [16,17]). Constraint-based techniques have also been applied for discovering non-linear polynomial invariants [13,18] and invariants in the combined theory of linear arithmetic and uninterpreted functions [19].…”

“…As a result, earlier work on constraint-based techniques (with the exception of [15]) has been limited to program verification as opposed to other program analysis problems such as weakest precondition generation. This paper demonstrates the applicability of constraint-based methodology to the problem of weakest precondition generation, which in turn can be used for generation of most-general counterexamples (assuming program termination).…”

“…This paper demonstrates the applicability of constraint-based methodology to the problem of weakest precondition generation, which in turn can be used for generation of most-general counterexamples (assuming program termination). The technique used for weakest precondition generation in [15] is based on binary search over arithmetic coefficients from a bounded range, while the technique used for weakest precondition generation in this paper relies on monotonicity of implication of a conjunctive set of predicates.…”

Learning Moore Machines from Input-Output Traces

“…Also related but different from ours is work in the areas of invariant generation and specification mining, which extract properties of a program or system model, such as invariants [22,13,23], temporal logic formulas [27,33] or non-deterministic finite automata [6].…”