ALICe: A Framework to Improve Affine Loop Invariant Computation Vivien Maisonneuve Olivier Hermant François Irigoin 5th International Workshop on Invariant Generation (WING) July 23, 2014
Introduction Need of abstract domains to represent complex program behaviors. x y Program analysis ⇒ computation of invariants (e.g. model checking). Here: affine invariants = systems of linear (in)equations. 2 / 23
• Branches • Loops Linear Relation Analysis if (b) x += 2; lots of research, programs convex hull Sources of approximation: } else x += 1, y += 1; b = rand(); Predicate propagation: forward / backward. while (x <= 100) { x = 0; y = 0; x y // 0 Loops? Widening Branches: convex union of invariants. 3 / 23
• Branches • Loops Linear Relation Analysis if (b) x += 2; lots of research, programs convex hull Sources of approximation: } else x += 1, y += 1; b = rand(); Predicate propagation: forward / backward. while (x <= 100) { x = 0; y = 0; x y // 0 Loops? Widening Branches: convex union of invariants. // x = y = 0 3 / 23
• Branches • Loops Predicate propagation: forward / backward. convex hull Sources of approximation: } else x += 1, y += 1; if (b) x += 2; b = rand(); Linear Relation Analysis lots of research, programs x = 0; y = 0; x y // 0 Loops? Widening Branches: convex union of invariants. while (x <= 100) { // x = y = 0 // x = y = 0 3 / 23
• Branches • Loops Linear Relation Analysis Predicate propagation: forward / backward. lots of research, programs convex hull Sources of approximation: } else x += 1, y += 1; if (b) x += 2; b = rand(); while (x <= 100) { x = 0; y = 0; x y // 0 Loops? Widening Branches: convex union of invariants. // x = y = 0 // x = y = 0 // x = 2 , y = 0 // x = 1 , y = 1 3 / 23
• Branches • Loops Linear Relation Analysis b = rand(); lots of research, programs convex hull Sources of approximation: } else x += 1, y += 1; Predicate propagation: forward / backward. if (b) x += 2; x = 0; y = 0; while (x <= 100) { x y // 0 Loops? Widening Branches: convex union of invariants. // x = y = 0 // x = y = 0 // x = 2 , y = 0 // x = 1 , y = 1 // 1 ≤ x ≤ 2 , x + y = 2 3 / 23
• Branches • Loops if (b) x += 2; Sources of approximation: } lots of research, programs else x += 1, y += 1; Predicate propagation: forward / backward. Linear Relation Analysis convex hull while (x <= 100) { x = 0; y = 0; Branches: convex union of invariants. b = rand(); Loops? Widening ⇒ // 0 ≤ y ≤ x // x = y = 0 // x = y = 0 // x = 2 , y = 0 // x = 1 , y = 1 // 1 ≤ x ≤ 2 , x + y = 2 3 / 23
Linear Relation Analysis b = rand(); Sources of approximation: } else x += 1, y += 1; Predicate propagation: forward / backward. if (b) x += 2; while (x <= 100) { x = 0; y = 0; Branches: convex union of invariants. Loops? Widening ⇒ // 0 ≤ y ≤ x // x = y = 0 // x = y = 0 // x = 2 , y = 0 // x = 1 , y = 1 // 1 ≤ x ≤ 2 , x + y = 2 • Branches ⇒ convex hull • Loops ⇒ lots of research, programs 3 / 23
ALICe Framework to compare several techniques & programs to compute affine loop invariants. Motivations: 1 Compare tools on a common set of previously published examples. 2 Study effects of input model restructurations. 3 Improve invariant computation in PIPS. 4 / 23
Contents 1 The Test Suite Test Cases Supported Tools Test Chain Results 2 Model Restructurations State Splitting Heuristic Using a Unique State Comparative Results 3 Improving Results in PIPS Transformer Lists Iterative Analysis Multiple Precision Arithmetic Results 5 / 23
Test Cases Transition systems with a finite number of vertices (“control states”), of integer variables. k Goal: E is unreachable. • Initial condition I on control states & variables. • Transitions t 1 , . . . , t n with guards and updates. • Error condition E on control states & variables. t 1 : x ≤ 0 ? x ++ I : x ≥ 0 ? E : x < 0 t 2 : x ≥ 1 ? x -- 6 / 23
Test Cases number of transitions 20 15 10 5 30 25 20 15 10 5 0 25 102 previously published test cases: from L. Gonnord, S. Gulwani, 20 15 10 5 10 5 0 number of control states Mostly: loop invariants, loop bounds, protocols. Small test cases: 1-10 control states, 2-15 transitions. N. Halbwachs, B. Jeannet et al. 7 / 23
Input Format update := x' = x + 1; Easy, existing base of models, c2fsm. } Region bad := {x < 0}; Region init := {x >= 0}; strategy S { } } ... transition t2 { } guard := x <= 0; Test cases are written in fsm format (Aspic format, introduced by FAST). to := k; from := k; transition t1 { states k; var x; model M { k t 1 : x ≤ 0 ? x ++ I : x ≥ 0 ? t 2 : x ≥ 1 ? x -- E : x < 0 8 / 23
Tools A 2 x 2 x 2 d 1 d 2 z e A 1 x 1 Bs Supported tools: Dz c more expressive than affine constraints ( Presburger). Models as relations. Sophisticated computation of transitive closure. x 1 R s c S s : affine invariant generator. Developed by L. Gonnord. Forward LRA + accelerations . : the Integer Set Library. Developed by S. Verdoolaege. A library for manipulating sets and relations of integer tuples bounded by affine Dz constraints: x d z e Ax Bs • Aspic • isl • PIPS 9 / 23
Tools x 1 Sophisticated computation of transitive closure. Models as relations. Presburger). more expressive than affine constraints ( c Dz Bs A 2 x 2 A 1 x 1 e z d 2 d 1 x 2 R s Supported tools: x Forward LRA + accelerations . : the Integer Set Library. Developed by S. Verdoolaege. A library for manipulating sets and relations of integer tuples bounded by affine constraints: c S s d z e Ax Bs Dz • Aspic : affine invariant generator. Developed by L. Gonnord. • isl • PIPS 9 / 23
Tools Models as relations. Forward LRA + accelerations . for manipulating sets and relations of integer tuples bounded by affine constraints: Sophisticated computation of transitive closure. Supported tools: • Aspic : affine invariant generator. Developed by L. Gonnord. • isl : the Integer Set Library. Developed by S. Verdoolaege. A library � ∃ z ∈ Z e : Ax + Bs + Dz ≥ c x ∈ Z d � � � S ( s ) = � ∃ z ∈ Z e : A 1 x 1 + A 2 x 2 + Bs + Dz ≥ c x 1 → x 2 ∈ Z d 1 × Z d 2 � � � R ( s ) = more expressive than affine constraints ( ∼ Presburger). • PIPS 9 / 23
PIPS Interprocedural source-to-source compiler framework for C and Fortran. x x 0 P // // x += 2; x x x x T // while (rand()) 42 x x 0 P // 2 Then, invariants Bottom-up procedure. represents the transfer function. 1 Program is abstracted: each program command instruction Code analysis: 2-step approach Initially developed at MINES ParisTech. (elementary or compound) is associated to an affine transformer that T = { ( x , x ′ ) | x ′ = x + 2 } Notation: x before, x ′ after. 10 / 23
PIPS x x x 0 P // // x += 2; // while (rand()) Interprocedural source-to-source compiler framework for C and Fortran. 42 x 0 P // 2 Then, invariants Bottom-up procedure. represents the transfer function. 1 Program is abstracted: each program command instruction Code analysis: 2-step approach Initially developed at MINES ParisTech. (elementary or compound) is associated to an affine transformer that T ∗ = { ( x , x ′ ) | x ′ ≥ x } T = { ( x , x ′ ) | x ′ = x + 2 } Notation: x before, x ′ after. 10 / 23
PIPS Interprocedural source-to-source compiler framework for C and Fortran. x x 0 P // // x += 2; // while (rand()) // 2 Then, invariants Bottom-up procedure. represents the transfer function. 1 Program is abstracted: each program command instruction Code analysis: 2-step approach Initially developed at MINES ParisTech. (elementary or compound) is associated to an affine transformer that P = { x | 0 ≤ x ≤ 42 } T ∗ = { ( x , x ′ ) | x ′ ≥ x } T = { ( x , x ′ ) | x ′ = x + 2 } Notation: x before, x ′ after. 10 / 23
PIPS // Initially developed at MINES ParisTech. Code analysis: 2-step approach 1 Program is abstracted: each program command instruction represents the transfer function. Bottom-up procedure. 2 Then, invariants are propagated along transformers. // Interprocedural source-to-source compiler framework for C and Fortran. while (rand()) // // x += 2; (elementary or compound) is associated to an affine transformer that P = { x | 0 ≤ x ≤ 42 } T ∗ = { ( x , x ′ ) | x ′ ≥ x } T = { ( x , x ′ ) | x ′ = x + 2 } P ′ = { x | 0 ≤ x } Notation: x before, x ′ after. 10 / 23
Test Chain out.isl Mostly written in OCaml, wrappers in Python. To challenge a tool T on a test case: isl isl isl in.fsm out.isl out.c out.isl out.asp PIPS isl Aspic in.c in.isl • convert test case into T ’s input language. • run T , get the resulting invariant in T ’s output language; • convert invariant in isl format; • check with isl that the invariant does not reach the error region. ⇒ Several wrappers and format conversion tools involved. 11 / 23
Comparative Results Out of 102 test cases: Slower, poor results with concurrent loops. Very fast on small cases, slower on bigger ones. Remarks: (Quad-core AMD Opteron Processor 2380 at 2.4 GHz, 16 GB RAM) 46.2 35.5 10.9 Time (s.) 43 63 75 Successes PIPS isl Aspic • Best results with Aspic (native format, ad-hoc tool). • isl very good with loops, not at ease with multiple states. • Average results with PIPS (default options). 12 / 23
Recommend
More recommend
