Combining Model�Checkin g and Abstra ct Interpret a t ion P arallel Combina tio n of Abstra ct Interpret a ti on Ho w� and Model�Based A utoma tic Anal ysis of Softw are �� Abstract symb olic metho ds� � � Use symb olic rep resent ations of p rop erties �BDDs� convex p oly� P atrick COUSOT Radhia COUSOT � � hedra� � � � � Ecole No rmale Sup � erieure CNRS � Ecole P olytechnique One can mak e app ro ximations �e�g� widenings� � � DMI� ��� rue d�Ulm LIX ����� P a ris cedex �� ����� P alaiseau cedex � Appr o xima t e pr oper ties of an exa ct model F rance F rance �� Mo del abstraction� cousot�d mi� en s� fr rcousot� li x� pol yt ec hn iq ue �fr The �nite mo del is an abstraction of the system � � http���w ww �e ns� fr � cousot http���li x� pol yt ec hn iq ue� fr � radhia � � � Exa ct pr oper ties of an appr o xima te model AAS���� P a ris� Janua ry ��� ���� � � In this p aper � � � Combining Model�Checkin g and Abstra ct Interpret a ti on �� P a rallel combination of mo del�checking and abstract interp retation� Why� � � Mo del�checking� � Exact symb olic rep resentat ion of p rop erties � The mo del is an exact rep resent ation of the system � Mo del�checking� � Exact p rop erties of exact mo del � � Finite state space Abstract interp retation� � � � � Sound and complete p rop ert y veri�cation � Prelimina ry�pa rallel analysis of the mo del b y abstract in� � Abstract Interp retation� terp retation In�nite state space � � � Limit the state sea rch space Sound but uncomplete p rop ert y determination � � � � Exa ct pr oper ties of an exa ct sub�model P �Cousot � R� Cousot � � AAS���� Jan� ��� ����
Example� Maximum Dela y Pr oblem Execution tra ce of the � maximum� � algorithm � Find the maximum dela y to reach a �nal state sta rting from some initial state� It is useless to explo re the states which a re not� � descendants of the initial states� � ascendants of the initial states� � � Maximum Dela y Algorithm � maximum� � � Maximum Dela y Algorithm � maximum� � �with st a te sear ch sp a ce restriction� pro cedure maximum� � I � F �� � �� � R S maximum� � I � �� pro cedure F �� � � n � �� � R S �� � S � � � R F �� � � n � � R � � � � � � � � while R R I do �� � U � � � R F � � �� R � R � � � � � while � R � � R R I � � do �� � � � n n � R �� R � � �� p re � t � � � S � � � R R F �� � � � n n o d � � �� p re � t � � � U � � � R R F n � return if � R � R � then � else n � o d � � � return if � R � R � then else n � � � � n � � def � where� � � U U � p ost � t � I p re � t � F � Halb w achs� N� Dela ys analysis in synchronous p rograms� CA V ���� LNCS ���� ����� pp� �������� n � Camp os� S�� Cla rk e� E�� Ma rrero� W�� and Minea� M� V erus� A to ol fo r quantitative analysis of �nite�state real�time systems� Pro c� A CM SIGPLAN ���� W o rkshop on Languages� Compilers � T o ols fo r Real�Time Systems� La Jolla� Calif�� jun ������ ����� pp� ������ P �Cousot � R� Cousot � � AAS���� Jan� ��� ����
� Execution tra ce of the � maximum� � algorithm Upper appr o xima tio n of post � t � � D I � lfp � post � t � by abstra ct interpret a ti on �X I X � � �� Consider an abstract domain h L� vi app ro ximating sets of states h � � S � � �i � �� de�ne a co rresp ondence� � � � h � � S � � �i � � h L� vi � which is a Galois connection� � P � � � S � � � Q � � � � P � v � � � � Q � L Q P � � � � The abstract value � � P � is the app ro ximation of P S � P � Any upp er�app ro ximations � � � � � � � � � � of can b e used� U U U U n � � � P �� � � � � � In the w o rst case � �all states�� hence �maximum� � � �maximum��� U S �� n �� De�ne an abstract p ost�image transfo rmer F � �� � L � L m � � Q � � � �X � p ost � t � � � Q � v F � Q � L � I X � � � � Anal ysis of the model by abstra ct interpret a t ion � �� De�ne a � � �� L � widening op erato r L L � W e can compute� � � it is an upp er app ro ximation � � � � it enfo rces �nite convergence of F �up w a rd iterates � � � � � � � � def � p ost � t � � p re � t � U U � � � U U I F n � � �� The up w a rd fo rw a rd iteration sequence with widening � b y abstract interp retation� � � F � � � � � � � � def � The abstract interp retation can b e done in pa rallel with the mo del� � � � � i �� i i i F F F F v F � � � def if � � checking �at almost no supplementa ry cost�� � � � i �� i � i F def F F F � � � � � otherwise � The abstract interp retation results a re used on the �y fo r as they U n is ultimately stationa ry� b ecome available to restrict the state sea rch space� � � F its limit is a sound upp er app ro ximation of p ost � t � I in that� � Several restriction op erato rs have b een p rop osed fo r symb olic mo del v � � checking �with BDDs � convex p olyhedra �� � p ost � t � � � lfp F � � � F � I � � � � Cousot� P � and Cousot� R� Abstract interp retation� a uni�ed lattice mo del fo r static analysis of p rograms b y construction o r app ro ximation of �xp oints� �th POPL� Los Angeles� ����� pp� �������� � � � � Halb w achs� N� and Ra ymond� P � On the use of app ro ximations in symb olic mo del checking� T ech� rep� SPECTRE L�� �jan ������ lab o rato ry � � x� y � L x v x y and � x� y � L y v x y � verima g � � � � � i � � i �� i � i �� Grenoble� F rance� fo r all increasing chains x v x v � � � v x v � � � the increasing chain de�ned b y y x � � � � � y y x � � � � is not strictly increasing� � � P �Cousot � R� Cousot �� �� AAS���� Jan� ��� ����
Recommend
More recommend