Citation Context

... area of fixed-point computation basedtechniques, the problem of generating precise invariants has led to development of several widening heuristics that are tailored to specific classes of programs =-=[40, 18, 16, 17]-=-. Our tool can uniformly discover precise invariants for all such programs. The goal of weakest precondition generation is to infer the weakest precondition that ensures validity of all assertions in ...

Citation Context

...se program analysis given an underlying invariant generation tool. This includes widening strategies (such as “look-ahead widening” [10] and “upto widening” [17]) or disjunctive extensions of domains =-=[13, 25, 11, 14]-=-. The primary goal of these techniques is to compute precise invariants at different program points in the original program, while we instead focus on creating a precise expansion of the program into ...

Citation Context

...loop which represents the transition system. Example 9 suggests the importance of these invariants to be precise, and hence disjunctive. There has been some work on discovering disjunctive invariants =-=[5, 16, 20, 29, 13, 14]-=- in general. We present below a technique that takes advantage of its particular application to bound analysis. (We also remark that our technique can be used in general for proving safety properties ...

Citation Context

...e loops into a sequence of single-phase loops. Interproc is an abstract interpretation-based tool that implements the interval, octagon, and polyhedra abstract domains using the Apron [9] and Fixpoint=-=[20]-=- libraries. In contrast to Interproc, InvGen is a template-based invariant generator (see Sect. 7), which employs non-linear constraint solving to find valid instantiations for the unknown parameters ...

Citation Context

... end Figure 10. Producer and consumer with wrong time synchronisation, analyzed with a cooperative scheduling policy (use of yield instructions) ask for precise analysis. Concerning running times, the size of the reachable part of the equation graph remains quite high: (217, 486) and (438, 800) for the two examples (in terms of nb. of locations and transitions). Barrier synchronisation algorithms. We now experiment a synchronisation barrier algorithm from [26], Fig. 8. Our method proves (in 4s) that thread T1 cannot reach the fail instruction, provided we use the guided iteration technique of [10] to prevent loss of information due to the widening on convex polyhedra. But if we make the counters p0, p1 local to the main procedure of each thread, our method fails to infer that p0 = p1 when the control is at the head of the two loops, because they become uncorrelated when both threads are in the procedure barrier: in this case neither the tail environments of thread t nor the top environments contains both counters: the relation between these counters is lost and cannot be recovered on procedure return. This is a typical case where the call-context taken into account, as discussed in §3,...

Citation Context

...30 1.04 OK fig9 [31] 10 1 2 1 0 0.030 0.99 OK prog2 [31] 19 1 2 10 0 0.034 1.00 OK prog3 [31] 29 1 4 8 126 0.106 1.05 OK test [31] 30 1 4 20 0 0.162 1.00 OK ex23 [36] 20 1 2 111 0 0.045 1.05 OK sas07 =-=[29]-=- 20 1 2 103 6112 2.64 1.02 OK popl07 [32] 20 1 2 101 10000 2.85 0.99 OK get-tag [35] 120 2 2 6 28 0.092 1.04 OK hsort [35] 47 2 5 15 435 0.19 1.05 OK maill-qp [35] 92 1 3 9 253 0.11 1.05 OK msort [35]...

Citation Context

... not, by behaving better with respect to the widening operators [8] used for enforcing convergence when searching for loop invariants by Kleene iterations. A related technique, guided static analysis =-=[15]-=-, computes successive loop invariants for increasing subsets of the transitions taken into account, until all transitions are considered; again, the claim is that this approach avoids some gross over-...