Inductive Reachability Witnesses

by   Ali Asadi, et al.

In this work, we consider the fundamental problem of reachability analysis over imperative programs with real variables. The reachability property requires that a program can reach certain target states during its execution. Previous works that tackle reachability analysis are either unable to handle programs consisting of general loops (e.g. symbolic execution), or lack completeness guarantees (e.g. abstract interpretation), or are not automated (e.g. incorrectness logic/reverse Hoare logic). In contrast, we propose a novel approach for reachability analysis that can handle general programs, is (semi-)complete, and can be entirely automated for a wide family of programs. Our approach extends techniques from both invariant generation and ranking-function synthesis to reachability analysis through the notion of (Universal) Inductive Reachability Witnesses (IRWs/UIRWs). While traditional invariant generation uses over-approximations of reachable states, we consider the natural dual problem of under-approximating the set of program states that can reach a target state. We then apply an argument similar to ranking functions to ensure that all states in our under-approximation can indeed reach the target set in finitely many steps.


page 1

page 2

page 3

page 4


On Higher-Order Reachability Games vs May Reachability

We consider the reachability problem for higher-order functional program...

On the Monniaux Problem in Abstract Interpretation

The Monniaux Problem in abstract interpretation asks, roughly speaking, ...

The Reachability of Computer Programs

Would it be possible to explain the emergence of new computational ideas...

Ranking and Repulsing Supermartingales for Reachability in Probabilistic Programs

Computing reachability probabilities is a fundamental problem in the ana...

Ranking and Repulsing Supermartingales for Approximating Reachability

Computing reachability probabilities is a fundamental problem in the ana...

LazySets.jl: Scalable Symbolic-Numeric Set Computations

LazySets.jl is a Julia library that provides ways to symbolically repres...

Reachability Logic for Low-Level Programs

Automatic exploit generation is a relatively new area of research. Work ...