Quantified Invariants via Syntax-Guided Synthesis

Fedyukovich, Grigory; Prabhu, Sumanth; Madhukar, K.; Gupta, Aarti

doi:10.1007/978-3-030-25540-4_14

Cited by 48 publications

(51 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, one can represent the memory state as a pair of an array h and an index sp indicating the maximum index that has been allocated so far. Finding quantified invariants is known to be difficult in general despite active studies on it [41,2,36,26,19] and most current array-supporting CHC solvers give up finding quantified invariants. In general, much more complex operations on pointers can naturally take place, which makes the universally quantified invariants highly involved and hard to automatically find.…”

Section: Challenges In Verifying Pointer-manipulating Programsmentioning

confidence: 99%

See 1 more Smart Citation

RustHorn: CHC-Based Verification for Rust Programs

Matsushita¹,

Tsukada²,

Kobayashi³

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Reduction to the satisfiablility problem for constrained Horn clauses (CHCs) is a widely studied approach to automated program verification. The current CHC-based methods for pointer-manipulating programs, however, are not very scalable. This paper proposes a novel translation of pointer-manipulating Rust programs into CHCs, which clears away pointers and heaps by leveraging ownership. We formalize the translation for a simplified core of Rust and prove its correctness. We have implemented a prototype verifier for a subset of Rust and confirmed the effectiveness of our method. 17 The first character of each variable indicates the pointer kind (o/m corresponds to own/mutα). We swap the branches of the match statement in take-max, to fit the order to C/Rust's if.

show abstract

Section: Challenges In Verifying Pointer-manipulating Programsmentioning

confidence: 99%

“…We introduce a special variable res to represent the result of a function. 19 For a label L in a function f in a program Π, we defineφ Π,f,L , Ξ Π,f,L and ∆ Π,f,L as follows, if the items in the variable context for the label are enumerated as x 0 : a0 T 0 , . .…”

Section: Translation From Cor Programs To Chcsmentioning

confidence: 99%

RustHorn: CHC-Based Verification for Rust Programs

Matsushita¹,

Tsukada²,

Kobayashi³

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Specifically, (i) we do not require explicit or implicit loop-specific invariants to be provided by the user or generated by a solver (viz. by constrained Horn clause solvers [20,14,9] or recurrence solvers [25,16]), (ii) we induct on the full program (possibly containing multiple loops) with parameter N and not on iterations of individual loops in the program, and (iii) we perform non-trivial correctby-construction code transformations, whenever feasible, to simplify the inductive step of reasoning. The combination of these factors often reduces reasoning about a program with multiple loops to reasoning about one with fewer (sometimes even none) and "simpler" loops, thereby simplifying proof goals.…”

Section: Introductionmentioning

confidence: 99%

“…1(a) using such techniques, it would be necessary to use appropriate loop-specific invariants for each of the three loops in Fig. 1 [9][10][11][12]. Unfortunately, automatically deriving such quantified non-linear loop invariants is far from trivial.…”

Section: Introductionmentioning

confidence: 99%

“…Among techniques that do not require explicit inductive invariants or mid-conditions for each loop, there are some that require loop invariants to be implicitly generated by a constraint solver. These include techniques based on constrained Horn clause solving [20,14,9,23], acceleration and lazy interpolation for arrays [1] and those that use inductively defined predicates and recurrence solving [25,16], among others. Thanks to the impressive capabilities of modern constraint solvers and the effectiveness of carefully tuned heuristics for stringing together multiple solvers, this approach has shown a lot of promise in recent years.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Verifying Array Manipulating Programs with Full-Program Induction

Chakraborty

Gupta

Unadkat

2020

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

We present a full-program induction technique for proving (a sub-class of) quantified as well as quantifier-free properties of programs manipulating arrays of parametric size N . Instead of inducting over individual loops, our technique inducts over the entire program (possibly containing multiple loops) directly via the program parameter N . Significantly, this does not require generation or use of loop-specific invariants. We have developed a prototype tool Vajra to assess the efficacy of our technique. We demonstrate the performance of Vajra vis-a-vis several state-of-the-art tools on a set of array manipulating benchmarks. // assume(true) 1. for (int t1=0; t1

show abstract

Putting the Squeeze on Array Programs: Loop Verification via Inductive Rank Reduction

Ish-Shalom

Itzhaky

Rinetzky

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Automatic verification of array manipulating programs is a challenging problem because it often amounts to the inference of inductive quantified loop invariants which, in some cases, may not even be first-order expressible. In this paper, we suggest a novel verification technique that is based on induction on user-defined rank of program states as an alternative to loop-invariants. Our technique, dubbed inductive rank reduction, works in two steps. Firstly, we simplify the verification problem and prove that the program is correct when the input state contains an input array of length ℓ B or less, using the length of the array as the rank of the state. Secondly, we employ a squeezing function which converts a program state σ with an array of length ℓ > ℓ B to a state (σ) containing an array of length ℓ−1 or less. We prove that when satisfies certain natural conditions then if the program violates its specification on σ then it does so also on (σ). The correctness of the program on inputs with arrays of arbitrary lengths follows by induction. We make our technique automatic for array programs whose length of execution is proportional to the length of the input arrays by (i) performing the first step using symbolic execution, (ii) verifying the conditions required of using Z3, and (iii) providing a heuristic procedure for synthesizing . We implemented our technique and applied it successfully to several interesting array-manipulating programs, including a bidirectional summation program whose loop invariant cannot be expressed in first-order logic while its specification is quantifier-free.

show abstract

Quantified Invariants via Syntax-Guided Synthesis

Cited by 48 publications

References 41 publications

RustHorn: CHC-Based Verification for Rust Programs

RustHorn: CHC-Based Verification for Rust Programs

Verifying Array Manipulating Programs with Full-Program Induction

Putting the Squeeze on Array Programs: Loop Verification via Inductive Rank Reduction

Contact Info

Product

Resources

About