Property Directed Inference of Relational Invariants

Equivalence checking of two programs is often reduced to the safety verification of a so-called product program that aligns the programs in lockstep. However, this strategy is not applicable when programs have arbitrary loop structures, e.g., the numbers of loops vary. We introduce an automatic iterative abstraction-refinement-based technique for checking equivalence of a single-loop program and a program which has a series of consecutive loops. Our approach decomposes the single loop into a sequence of separate loops thus reducing the main problem to a series of equivalence-checking problems for pairs of loops. Since due to the decomposition, these problems become abstract, our approach iteratively refines the decomposed loops and lifts useful information across them. Our second contribution is a procedure for the alignment of loops with counters and explicit bounds that cannot be composed in lockstep. We have implemented the approach and successfully evaluated it on two suites, one with benchmarks containing different numbers of loops and the other containing benchmarks that need alignment.

show abstract

“…More recently, there has been a rise of automated product construction techniques. e.g., [7,16,25,26].…”

Section: Related Workmentioning

confidence: 99%

Lockstep Composition for Unbalanced Loops

Hamza

Fedyukovich

2023

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Accordingly, a system is non-linear if at least one of its clauses is non-linear. Such systems of Constrained Horn Clauses are more difficult to solve than linear systems [20]. Rules are the Constrained Horn Clauses containing an uninterpreted predicate in the implication conclusion.…”

Section: Constrained Horn Clausesmentioning

confidence: 99%

HornFuzz: Fuzzing CHC solvers

Суханова

Sobol

2023

Proceedings of the 27th International Conference on Evaluation and Assessment in Software Engineering

View full text Add to dashboard Cite

Many advanced program analysis and verification methods are based on solving systems of Constrained Horn Clauses (CHC). Testing CHC solvers is very important, as correctness of their work determines whether bugs in the analyzed programs are detected or missed. One of the well-established and efficient methods of automated software testing is fuzzing: analyzing the reactions of programs to random input data. Currently, there are no fuzzers for CHC solvers, and fuzzers for SMT solvers are not efficient in CHC solver testing, since they do not consider CHC specifics. In this paper, we present HornFuzz, a mutation-based gray-box fuzzing technique for detecting bugs in CHC solvers based on the idea of metamorphic testing. We evaluated our fuzzer on one of the highest performing CHC solvers, Spacer, and found a handful of bugs in Spacer. In particular, some discovered problems are so serious that they require fixes with significant changes to the solver. CCS CONCEPTS• Software and its engineering → Software verification and validation.

show abstract

Bridging Arrays and ADTs in Recursive Proofs

Fedyukovich

Ernst

2021

Tools and Algorithms for the Construction and Analysis of Systems

Self Cite

View full text Add to dashboard Cite

We present an approach to synthesize relational invariants to prove equivalences between object-oriented programs. The approach bridges the gap between recursive data types and arrays that serve to represent internal states. Our relational invariants are recursively-defined, and thus are valid for data structures of unbounded size. Based on introducing recursion into the proofs by observing and lifting the constraints from joint methods of the two objects, our approach is fully automatic and can be seen as an algorithm for solving Constrained Horn Clauses (CHC) of a specific sort. It has been implemented on top of the SMT-based CHC solver AdtChc and evaluated on a range of benchmarks.

show abstract

Property Directed Inference of Relational Invariants

Cited by 10 publications

References 14 publications

Lockstep Composition for Unbalanced Loops

Lockstep Composition for Unbalanced Loops

HornFuzz: Fuzzing CHC solvers

Bridging Arrays and ADTs in Recursive Proofs

Contact Info

Product

Resources

About