Program analysis as constraint solving

Abstract

A constraint-based approach to invariant generation in programs translates a program into constraints that are solved using off-theshelf constraint solvers to yield desired program invariants.In this paper we show how the constraint-based approach can be used to model a wide spectrum of program analyses in an expressive domain containing disjunctions and conjunctions of linear inequalities. In particular, we show how to model the problem of context-sensitive interprocedural program verification. We also present the first constraint-based approach to weakest precondition and strongest postcondition inference. The constraints we generate are boolean combinations of quadratic inequalities over integer variables. We reduce these constraints to SAT formulae using bitvector modeling and use off-the-shelf SAT solvers to solve them.Furthermore, we present interesting applications of the above analyses, namely bounds analysis and generation of most-general counter-examples for both safety and termination properties. We also present encouraging preliminary experimental results demonstrating the feasibility of our technique on a variety of challenging examples.

Symbolic Resource Bound Inference for Functional Programs

“…However, the incompleteness did not manifest in any of our experiments. Similar observation has also been documented in the previous works such as [15].…”

“…This approach has been used by previous works [7,9,15] to infer linear invariants for numerical programs. There are two important points to note about this approach: (a) In the presence of real valued variables, handling strict inequalities in the parametric formula requires an extension based on Motzkin's transposition theorem as discussed in [24].…”

“…Our approach also supports algebraic data types and handles sophisticated templates that involve user-defined functions. The idea of using Farkas' lemma to solve linear templates of numerical programs goes back at least to the work of [7] and has been generalized in different directions by [25], [9], [15]. [9] and [25] present systematic approaches for solving nonlinear templates for numerical programs.…”

Beautiful Interpolants

“…The benchmarks f2, gulv*, and substring1 are from [15]. The benchmarks pldi08* are from [16]. The benchmarks xy* are variations on a classic two-loop example requiring linear congruences.…”

Development and user testing of new user interfaces for mathematics and programming tools

“…While fully-automatic SAT solvers (for propositional satisfiability) and SMT (satisfiability modulo theory) solvers are being used to implement advanced static analysis techniques with promising results (e.g. [58,46]) and can determine the satisfiability of large numbers of large formulas, keeping humans involved in the theorem proving process allows the search for a proof to be tailored to the particular theorem at hand, and therefore allows a wider range, in a sense, of theorems to be proved. Furthermore, contrary to what might have been suggested by the step-by-step detail of the example above, many subproblems can be solved automatically by Coq and other interactive theorem provers, and work is being done to send subproblems of interactive theorem provers to automatic tools [36] in order to combine the best of both worlds.…”