Automatic generation of polynomial invariants of bounded degree using abstract interpretation

Abstract

A method for generating polynomial invariants of imperative programs is presented using the abstract interpretation framework. It is shown that for programs with polynomial assignments, an invariant consisting of a conjunction of polynomial equalities can be automatically generated for each program point. The proposed approach takes into account tests in conditional statements as well as in loops, insofar as they can be abstracted into polynomial equalities and disequalities. The semantics of each program statement is given as a transformation on polynomial ideals. Merging of execution paths is defined as the intersection of the polynomial ideals associated with each path. For loop junctions, a family of widening operators based on selecting polynomials up to a certain degree is proposed. The presented method has been implemented and successfully tried on many programs. Heuristics employed in the implementation to improve its efficiency are discussed, and tables providing details about its performance are included.

A Data Driven Approach for Algebraic Loop Invariants

“…One might try to achieve completeness for Guess-and-Check by giving up soundness. Just as [23,4,21], if we interpret program variables as real numbers then Z3 does have a sound and complete decision procedure for non-linear real arithmetic [12] that has been demonstrated to be practical. Since Z3 supports both non-linear integer and real arithmetic, we can easily combine or switch between the two, if desired (see Section 6).…”

“…Benchmarks The benchmarks over which we evaluated the Guess-and-Check algorithm are from a number of recent research papers on inferring algebraic invariants [21][22][23]. These are shown in the first column of Table 1.…”

“…Recently, researchers have also applied these techniques to the generation of non-linear loop invariants [23,17,21,22,18]. These techniques discover algebraic invariants, that is, invariants of the form ∧ i f i (x 1 , .…”

“…First, these techniques either restrict predicates on branches to either equalities or dis-equalities [6,17], or cannot handle nested loops [15,22], or interpret program variables as real numbers [23,4,21]. It is well known that the semantics of a program assuming integer variables, in the presence of division and modulo operators, is not over-approximated by the semantics of the program assuming real variables.…”

Verification as Learning Geometric Concepts

“…Existing sound tools for non-linear invariant generation can produce invariants that are conjunctions of polynomial equalities [51,38,50,14,46,53,17]. However, by imposing strict restrictions on syntax (such as no nested loops) [51,38] do not need to assume the degree of polynomials as the input.…”