# Invariant Generation through Strategy Iteration in Succinctly Represented Control Flow Graphs

@article{Gawlitza2012InvariantGT, title={Invariant Generation through Strategy Iteration in Succinctly Represented Control Flow Graphs}, author={Thomas Gawlitza and David Monniaux}, journal={Log. Methods Comput. Sci.}, year={2012}, volume={8} }

We consider the problem of computing numerical invariants of programs, for
instance bounds on the values of numerical program variables. More
specifically, we study the problem of performing static analysis by abstract
interpretation using template linear constraint domains. Such invariants can be
obtained by Kleene iterations that are, in order to guarantee termination,
accelerated by widening operators. In many cases, however, applying this form
of extrapolation leads to invariants that are…

## 13 Citations

### Finding inductive invariants using satisfiability modulo theories and convex optimization. (Recherche d'invariants inductifs par satisfiabilité modulo théorie et optimisation convexe)

- Computer Science
- 2017

A novel "formula slicing'' method for finding potentially disjunctive inductive invariants from program fragments obtained by symbolic execution is developed, and an algorithm parameterizable with any abstract interpretation for summary generation is developed and studied.

### Inductive Reachability Witnesses

- Computer ScienceArXiv
- 2020

This work considers the natural dual problem of under-approximating the set of program states that can reach a target state and extends techniques from both invariant generation and ranking-function synthesis to reachability analysis through the notion of (Universal) Inductive Reachability Witnesses (IRWs/UIRWs).

### Scaling up logico-numerical strategy iteration (extended version)

- Computer ScienceArXiv
- 2014

A modification of the strategy iteration algorithm where the strategies are stored succinctly, and the linear programs to be solved at each iteration step are simplified according to an equivalence relation.

### Descending chains and narrowing on template abstract domains

- Computer Science, MathematicsActa Informatica
- 2016

This work provides an abstract semantics which improves the analysis precision and shows that, for a large class of numerical abstract domains over integer variables, infinite descending chains cannot arise and the authors can safely omit narrowing.

### Narrowing Operators on Template Abstract Domains

- MathematicsFM
- 2015

It is shown that, for a large class of numerical abstract domains over integer variables (such as intervals, octagons and template polyhedra), it is possible to avoid infinite descending chains and omit narrowing.

### Speeding Up Logico-Numerical Strategy Iteration

- Computer ScienceSAS
- 2014

This work proposes a modification of the strategy iteration algorithm where the strategies are stored succinctly, and the linear programs to be solved at each iteration step are simplified according to an equivalence relation.

### Program Analysis with Local Policy Iteration

- Computer ScienceVMCAI
- 2016

We present local policy iterationi¾?LPI, a new algorithm for deriving numerical invariants that combines the precision of max-policy iteration with the flexibility and scalability of conventional…

### How Hard is It to Verify Flat Affine Counter Systems with the Finite Monoid Property?

- MathematicsATVA
- 2016

This work provides complexity bounds for several decision problems of counter systems with guards defined by convex polyhedra and updates defined by affine transformations, by proving that reachability and model checking for Past Linear Temporal Logic stands in the second level of the polynomial hierarchy.

### Safety Problems Are NP-complete for Flat Integer Programs with Octagonal Loops

- Computer ScienceVMCAI
- 2014

This paper proves the NP-completeness of the reachability problem for the class of flat counter machines with difference bounds and octagonal relations, labeling the transitions on the loops, and has a potential impact on other problems in program verification.

### On the decidability of the existence of polyhedral invariants in transition systems

- MathematicsActa Informatica
- 2018

Automated program verification often proceeds by exhibiting inductive invariants entailing the desired properties. For numerical properties, a classical class of invariants is convex polyhedra:…

## References

SHOWING 1-10 OF 74 REFERENCES

### Improving Strategies via SMT Solving

- Computer ScienceESOP
- 2011

The algorithm has low polynomial space complexity and performs for contrived examples in the worst case exponentially many strategy improvement steps; this is unsurprising, since the associated abstract reachability problem is Pi-p-2-complete.

### Guided Static Analysis

- Computer ScienceSAS
- 2007

guided static analysis is introduced, a framework for controlling the exploration of the state-space of a program by applying standard static-analysis techniques to a sequence of modified versions of the analyzed program, and does not require any modifications to existing analysis techniques, and thus can be easily integrated into existingstatic-analysis tools.

### Static Analysis by Policy Iteration on Relational Domains

- Computer ScienceESOP
- 2007

We give a new practical algorithm to compute, in finite time, a fixpoint (and often the least fixpoint) of a system of equations in the abstract numerical domains of zones and templates used for…

### Accelerated Data-Flow Analysis

- Computer ScienceSAS
- 2007

The acceleration framework for symbolic verification is extended to data-flow analysis and a cubic-time acceleration-based algorithm for solving interval constraints with full multiplication is provided.

### Symbolic Methods to Enhance the Precision of Numerical Abstract Domains

- Computer ScienceVMCAI
- 2006

These lightweight and generic symbolic methods to improve the precision of numerical static analyses based on Abstract Interpretation, and are incorporated within the Astree static analyzer that checks for the absence of run-time errors in embedded critical avionics software.

### Using Bounded Model Checking to Focus Fixpoint Iterations

- Computer ScienceSAS
- 2011

This article describes how to avoid systematic exploration in static analysis by focusing on a single path at a time, designated by SMT-solving, thus doing away with widenings as well in some cases.

### Automatic modular abstractions for template numerical constraints

- Computer ScienceLog. Methods Comput. Sci.
- 2010

The motivation of the work is data-flow synchronous programming languages, used for building control-command embedded systems, but it also applies to imperative and functional programming.

### Efficient chaotic iteration strategies with widenings

- Computer ScienceFormal Methods in Programming and Their Applications
- 1993

This paper studies precise and efficient chaotic iteration strategies for computing fixed points of continuous functions over complete lattices of program properties when lattices are of infinite height and speedup techniques have to be used.

### Succinct Representations for Abstract Interpretation

- Computer ScienceArXiv
- 2012

This work improves previously proposed techniques for guided static analysis and the generation of disjunctive invariants by combining them with techniques for succinct representations of paths and symbolic representations for transitions based on static single assignment.

### Handbook of Satisfiability: Volume 185 Frontiers in Artificial Intelligence and Applications

- Computer Science
- 2009

This collection of papers on all theoretical and practical aspects of SAT solving will be extremely useful to both students and researchers and will lead to many further advances in the field.