Nonindigenous bigheaded carps (Bighead Carp Hypophthalmichthys nobilis and Silver Carp H. molitrix; hereafter, “Asian carps” [AC]) threaten to invade and disrupt food webs and fisheries in the Laurentian Great Lakes through their high consumption of plankton. To quantify the potential effects of AC on the food web in Lake Erie, we developed an Ecopath with Ecosim (EwE) food web model and simulated four AC diet composition scenarios (high, low, and no detritus and low detritus with Walleye Sander vitreus and Yellow Perch Perca flavescens larvae) and two nutrient load scenarios (the 1999 baseline load and 2× the baseline [HP]). We quantified the uncertainty of the potential AC effects by coupling the EwE model with estimates of parameter uncertainty in AC production, consumption, and predator diets obtained using structured expert judgment. Our model projected mean ± SD AC equilibrium biomass ranging from 52 ± 34 to 104 ± 75 kg/ha under the different scenarios. Relative to baseline simulations without AC, AC invasion under all detrital diet scenarios decreased the biomass of most fish and zooplankton groups. The effects of AC in the HP scenario were similar to those in the detrital diet scenarios except that the biomasses of most Walleye and Yellow Perch groups were greater under HP because these fishes were buffered from competition with AC by increased productivity at lower trophic levels. Asian carp predation on Walleye and Yellow Perch larvae caused biomass declines among all Walleye and Yellow Perch groups. Large food web impacts of AC occurred in only 2% of the simulations, where AC biomass exceeded 200 kg/ha, resulting in biomass declines of zooplankton and planktivorous fish near the levels observed in the Illinois River. Our findings suggest that AC would affect Lake Erie's food web by competing with other planktivorous fishes and by providing additional prey for piscivores. Our methods provide a novel approach for including uncertainty into forecasts of invasive species' impacts on aquatic food webs.

Automatic generation of non-linear loop invariants is a long-standing challenge in program analysis, with many applications. For instance, reasoning about exponentials provides a way to find invariants of digital-filter programs, and reasoning about polynomials and/or logarithms is needed for establishing invariants that describe the time or memory usage of many well-known algorithms. An appealing approach to this challenge is to exploit the powerful recurrence-solving techniques that have been developed in the field of computer algebra, which can compute exact characterizations of non-linear repetitive behavior. However, there is a gap between the capabilities of recurrence solvers and the needs of program analysis: (1) loop bodies are not merely systems of recurrence relationsÐthey may contain conditional branches, nested loops, non-deterministic assignments, etc., and (2) a client program analyzer must be able to reason about the closed-form solutions produced by a recurrence solver (e.g., to prove assertions).This paper presents a method for generating non-linear invariants of general loops based on analyzing recurrence relations. The key components are an abstract domain for reasoning about non-linear arithmetic, a semantics-based method for extracting recurrence relations from loop bodies, and a recurrence solver that avoids closed forms that involve complex or irrational numbers. Our technique has been implemented in a program analyzer that can analyze general loops and mutually recursive procedures. Our experiments show that our technique shows promise for non-linear assertion-checking and resource-bound generation.

Compositional recurrence analysis (CRA) is a static-analysis method based on an interesting combination of symbolic analysis and abstract interpretation. This paper addresses the problem of creating a context-sensitive interprocedural version of CRA that handles recursive procedures. The problem is non-trivial because there is an "impedance mismatch" between CRA, which relies on analysis techniques based on regular languages (i.e., Tarjan's pathexpression method), and the context-free-language underpinnings of context-sensitive analysis.We address this issue by showing that we can make use of a recently developed framework-Newtonian Program Analysis via Tensor Product (NPA-TP)-that reconciles this impedance mismatch when the abstract domain supports a few special operations. Our approach introduces new problems that are not addressed by NPA-TP; however, we are able to resolve those problems. We call the resulting algorithm Interprocedural CRA (ICRA).Our experimental study of ICRA shows that it has broad overall strength. The study showed that ICRA is both faster and handles more assertions than two state-of-the-art software model checkers. It also performs well when applied to the problem of establishing bounds on resource usage, such as memory used or execution time.

We consider the problem of automatically establishing that a given syntax-guided-synthesis (SyGuS) problem is unrealizable (i.e., has no solution). Existing techniques have quite limited ability to establish unrealizability for general SyGuS instances in which the grammar describing the search space contains infinitely many programs. By encoding the synthesis problem's grammar G as a nondeterministic program PG, we reduce the unrealizability problem to a reachability problem such that, if a standard program-analysis tool can establish that a certain assertion in PG always holds, then the synthesis problem is unrealizable.Our method can be used to augment existing SyGuS tools so that they can establish that a successfully synthesized program q is optimal with respect to some syntactic cost-e.g., q has the fewest possible if-thenelse operators. Using known techniques, grammar G can be transformed to generate the set of all programs with lower costs than q-e.g., fewer conditional expressions. Our algorithm can then be applied to show that the resulting synthesis problem is unrealizable. We implemented the proposed technique in a tool called nope. nope can prove unrealizability for 59/132 variants of existing linear-integer-arithmetic SyGuS benchmarks, whereas all existing SyGuS solvers lack the ability to prove that these benchmarks are unrealizable, and time out on them.1 Grammar G2 only generates terms that are equivalent to some linear function of x and y; however, the maximum function cannot be described by a linear function. 2 The synthesis problem presented above is one that is generated by a recent tool called QSyGuS, which extends SyGuS with quantitative syntactic objectives [10]. The advantage of using quantitative objectives in synthesis is that they can be used to produce higher-quality solutions-e.g., smaller, more readable, more efficient, etc. The synthesis problem (ψmax2(f, x, y), G2) arises from a QSyGuS problem in which the goal is to produce an expression that (i) satisfies the specification ψmax2(f, x, y), and (ii) uses the smallest possible number of if-then-else operators. Existing SyGuS solvers can easily produce a solution that uses one if-then-else operator, but cannot prove that no better solution exists-i.e., (ψmax2(f, x, y), G2) is unrealizable.

Abstract. This paper addresses the problem of proving a given invariance property ϕ of a loop in a numeric program, by inferring automatically a stronger inductive invariant ψ. The algorithm we present is based on both abstract interpretation and constraint solving. As in abstract interpretation, it computes the effect of a loop using a numeric abstract domain. As in constraint satisfaction, it works from "above"-interactively splitting and tightening a collection of abstract elements until an inductive invariant is found. Our experiments show that the algorithm can find non-linear inductive invariants that cannot normally be obtained using intervals (or octagons), even when classic techniques for increasing abstract-interpretation precision are employed-such as increasing and decreasing iterations with extrapolation, partitioning, and disjunctive completion. The advantage of our work is that because the algorithm uses standard abstract domains, it sidesteps the need to develop complex, non-standard domains specialized for solving a particular problem.