Inductive Reachability Witnesses

07/28/2020
by   Ali Asadi, et al.
0

In this work, we consider the fundamental problem of reachability analysis over imperative programs with real variables. The reachability property requires that a program can reach certain target states during its execution. Previous works that tackle reachability analysis are either unable to handle programs consisting of general loops (e.g. symbolic execution), or lack completeness guarantees (e.g. abstract interpretation), or are not automated (e.g. incorrectness logic/reverse Hoare logic). In contrast, we propose a novel approach for reachability analysis that can handle general programs, is (semi-)complete, and can be entirely automated for a wide family of programs. Our approach extends techniques from both invariant generation and ranking-function synthesis to reachability analysis through the notion of (Universal) Inductive Reachability Witnesses (IRWs/UIRWs). While traditional invariant generation uses over-approximations of reachable states, we consider the natural dual problem of under-approximating the set of program states that can reach a target state. We then apply an argument similar to ranking functions to ensure that all states in our under-approximation can indeed reach the target set in finitely many steps.

READ FULL TEXT

page 1

page 2

page 3

page 4

03/16/2022

On Higher-Order Reachability Games vs May Reachability

We consider the reachability problem for higher-order functional program...
07/18/2019

On the Monniaux Problem in Abstract Interpretation

The Monniaux Problem in abstract interpretation asks, roughly speaking, ...
08/23/2017

The Reachability of Computer Programs

Would it be possible to explain the emergence of new computational ideas...
05/28/2018

Ranking and Repulsing Supermartingales for Reachability in Probabilistic Programs

Computing reachability probabilities is a fundamental problem in the ana...
05/28/2018

Ranking and Repulsing Supermartingales for Approximating Reachability

Computing reachability probabilities is a fundamental problem in the ana...
10/04/2021

LazySets.jl: Scalable Symbolic-Numeric Set Computations

LazySets.jl is a Julia library that provides ways to symbolically repres...
03/31/2022

Reachability Logic for Low-Level Programs

Automatic exploit generation is a relatively new area of research. Work ...