Solvers Principles and Architecture (SPA) Part 2 Abstract - PowerPoint PPT Presentation

Solvers Principles and Architecture (SPA) Part 2 Abstract Interpretation (Basics) Master Sciences Informatique (Sif) September, 2019 Rennes Khalil Ghorbal k halil.ghorbal@inria.fr K. Ghorbal (INRIA) 1 SIF M2 1 / 13

Abstract Interpretation : Intuitions S i K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Abstract Interpretation : Intuitions S i K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Abstract Interpretation : Intuitions S i K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Abstract Interpretation : Intuitions S i ➻ What about the missed bugs ? are they severe ? K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Abstract Interpretation : Intuitions S i K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Abstract Interpretation : Intuitions S i K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Abstract Interpretation : Intuitions S i K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Abstract Interpretation : Intuitions S i ➻ Over-approximation may lead to false alarms . K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Abstract Interpretation : Intuitions S i ➻ Accurate over-approximation gives a safety proof . K. Ghorbal (INRIA) 2 SIF M2 2 / 13

Famous bugs Examples • 1982, The Vancouver stock exchange: after 22 months the index had fallen to 524 , 811 instead of 1098 , 811 • 1985, Therac 25 (radiation therapy machine) : 5 patients killed (overdoses of radiation) • 1991, The Patriot Missile: 28 soldiers killed • 1996, Ariane 5: more than 1 billion $ gone in 40 seconds E. Dijkstra (1972) Program testing can be used to show the presence of bugs, but never to show their absence! K. Ghorbal (INRIA) 3 SIF M2 3 / 13

Detailed example ➊ y = x 2 − x begin x = [0,10]; ➊ ➋ y ≥ 0 y < 0 y = x*x - x ➋ if (y >= 0) ➌ then y = x / 10; ➍ ➌ ➎ else ➎ y = x 2 + 2 y = x 10 y = x*x + 2; ➏ done; ➐ ➍ ➏ end ∪ ➐ K. Ghorbal (INRIA) 4 SIF M2 4 / 13

Forward Propagation x =[0 , 10] y = x 2 − x ➋ y ≥ 0 y < 0 ➌ ➎ y = x y = x 2 +2 10 ➍ ➏ ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Forward Propagation x =[0 , 10] y = x 2 − x x =[0 , 10] y =[ − 10 , 100] y ≥ 0 y < 0 ➌ ➎ y = x y = x 2 +2 10 ➍ ➏ ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Forward Propagation x =[0 , 10] y = x 2 − x x =[0 , 10] y =[ − 10 , 100] y ≥ 0 y < 0 ➎ x =[0 , 10] y =[0 , 100] y = x 2 +2 y = x ➏ 10 ➍ ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Forward Propagation x =[0 , 10] y = x 2 − x x =[0 , 10] y =[ − 10 , 100] y ≥ 0 y < 0 x =[0 , 10] x =[0 , 10] y =[0 , 100] y =[ − 10 , 0] y = x y = x 2 +2 10 ➍ ➏ ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Forward Propagation x =[0 , 10] y = x 2 − x x =[0 , 10] y =[ − 10 , 100] y ≥ 0 y < 0 x =[0 , 10] x =[0 , 10] y =[0 , 100] y =[ − 10 , 0] y = x y = x 2 +2 10 ➏ x =[0 , 10] y =[0 , 1] ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Forward Propagation x =[0 , 10] y = x 2 − x x =[0 , 10] y =[ − 10 , 100] y ≥ 0 y < 0 x =[0 , 10] x =[0 , 10] y =[0 , 100] y =[ − 10 , 0] y = x y = x 2 +2 10 x =[0 , 10] x =[0 , 10] y =[0 , 1] y =[2 , 102] ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Forward Propagation x =[0 , 10] y = x 2 − x x =[0 , 10] y =[ − 10 , 100] y invariant in ➐ y ≥ 0 y < 0 102 x =[0 , 10] x =[0 , 10] y =[0 , 100] y =[ − 10 , 0] y = x y = x 2 +2 10 x 1 10 x =[0 , 10] x =[0 , 10] y =[0 , 1] y =[2 , 102] ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Forward Propagation x =[0 , 10] y = x 2 − x x =[0 , 10] y =[ − 10 , 100] y invariant in ➐ y ≥ 0 y < 0 102 102 x =[0 , 10] x =[0 , 10] y =[0 , 100] y =[ − 10 , 0] y = x y = x 2 +2 10 x 3 1 10 x =[0 , 10] x =[0 , 10] y =[0 , 1] y =[2 , 102] ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Forward Propagation x =[0 , 10] y = x 2 − x x =[0 , 10] y =[ − 0 . 25 , 90] y invariant in ➐ y ≥ 0 y < 0 102 102 x =[0 , 10] x =[0 , 1] y =[0 , 90] y =[ − 0 . 25 , 0] y = x y = x 2 +2 10 x 3 1 10 x =[0 , 10] x =[0 , 1] y =[0 , 1] y =[2 , 3] ∪ ➐ K. Ghorbal (INRIA) 5 SIF M2 5 / 13

Precision Cost Trade-off Cost box Precision K. Ghorbal (INRIA) 6 SIF M2 6 / 13

Precision Cost Trade-off Cost octagon box Precision K. Ghorbal (INRIA) 6 SIF M2 6 / 13

Precision Cost Trade-off Cost template octagon box Precision K. Ghorbal (INRIA) 6 SIF M2 6 / 13

Precision Cost Trade-off Cost polyhedron template octagon box Precision K. Ghorbal (INRIA) 6 SIF M2 6 / 13

Precision Cost Trade-off Cost polyhedron template octagon box Precision K. Ghorbal (INRIA) 6 SIF M2 6 / 13

Precision Cost Trade-off Cost polyhedron template octagon box zonotope Precision K. Ghorbal (INRIA) 6 SIF M2 6 / 13

Precision Cost Trade-off Cost polyhedron template octagon box constrained zonotope zonotope Precision K. Ghorbal (INRIA) 6 SIF M2 6 / 13

Outlines 1 Static Analysis-based Abstract Interpretation K. Ghorbal (INRIA) 7 SIF M2 7 / 13

Formal Verification Approaches Formal Verification Approaches • Hoare 1969: wrap the code of interest with preconditions and postconditions, then prove that postconditions are met • Clarke, Emerson et Sifakis 1974: model checking • Cousot(s) 1977: Abstract Interpretation Properties of Interest • run time errors: overflow, division by zero, square root of negatives, etc. • robustness and stability of algorithms: linear and non linear recursive schemes, filters, etc. K. Ghorbal (INRIA) 8 SIF M2 8 / 13

Formal Verification Approaches Formal Verification Approaches • Hoare 1969: wrap the code of interest with preconditions and postconditions, then prove that postconditions are met • Clarke, Emerson et Sifakis 1974: model checking • Cousot(s) 1977: Abstract Interpretation Properties of Interest • run time errors: overflow, division by zero, square root of negatives, etc. • robustness and stability of algorithms: linear and non linear recursive schemes, filters, etc. K. Ghorbal (INRIA) 8 SIF M2 8 / 13

Formal Verification Approaches Formal Verification Approaches • Hoare 1969: wrap the code of interest with preconditions and postconditions, then prove that postconditions are met • Clarke, Emerson et Sifakis 1974: model checking • Cousot(s) 1977: Abstract Interpretation Properties of Interest • run time errors: overflow, division by zero, square root of negatives, etc. • robustness and stability of algorithms: linear and non linear recursive schemes, filters, etc. K. Ghorbal (INRIA) 8 SIF M2 8 / 13

Formal Verification Approaches Formal Verification Approaches • Hoare 1969: wrap the code of interest with preconditions and postconditions, then prove that postconditions are met • Clarke, Emerson et Sifakis 1974: model checking • Cousot(s) 1977: Abstract Interpretation Properties of Interest • run time errors: overflow, division by zero, square root of negatives, etc. • robustness and stability of algorithms: linear and non linear recursive schemes, filters, etc. K. Ghorbal (INRIA) 8 SIF M2 8 / 13

Abstract Interpretation, an overview • Program semantics formalized as a fixpoint of a monotonic operator in a complete partially ordered set (exemplified later), • Fully automated, • Industrial tools exists : Polyspace Verifier (MathWorks), Astr˜ Al’e (ENS/ABSINT), Fluctuat (CEA), aIT (ABSINT), F-Soft (Nec Labs) . . . Challenge find the suitable abstract domain for the properties of interest. K. Ghorbal (INRIA) 9 SIF M2 9 / 13

Equations System (collecting semantic) ➊ y = x 2 − x  X 1 = � V → I � ♭ ➋  X 2 = � y ← x 2 − x � ♭ ( X 1 )  y ≥ 0 y < 0     X 3 = � y ≥ 0 � ♭ ( X 2 )     10 � ♭ ( X 3 ) X 4 = � y ← x ➌ ➎ X 5 = � y < 0 � ♭ ( X 2 )  y = x 2 + 2  y = x  X 6 = � y ← x 2 + 2 � ♭ ( X 5 ) 10      ➍ ➏  X 7 = X 6 ∪ X 4  ∪ ➐ K. Ghorbal (INRIA) 10 SIF M2 10 / 13

Solving the equations system • D = ( ℘ ( V → I ) , ⊆ , ∪ , ∩ , ∅ , ( V → I )) is a complete lattice • each operator X �→ F ( X ) is monotonic ➺ Tarski Theorem ensures the existence of a least fixpoint for F ➺ Kleene Iteration Technique reaches the least fixpoint Issues � ℘ ( V → I ) is non representable in finite memory, � � . � ♭ are non computable, � Iterations over the lattice may be transfinite. K. Ghorbal (INRIA) 11 SIF M2 11 / 13

Concretisation-Based Abstract Interpretation α γ ( X ♯ X ♯ X 1 ⊆ 1 ) 1 γ � y ← x 2 − x � ♯ � y ← x 2 − x � ♭ γ ( X ♯ X ♯ X 2 ⊆ 2 ) 2 γ concrete domain abstract domain over approximation K. Ghorbal (INRIA) 12 SIF M2 12 / 13

Building an abstract domain • lattice-like structure: • abstract objects • order relation (preorder over abstract objects) • monotonic concretisation function ( γ ) • Transfer Functions • evaluation of arithmetic expressions ( � x 2 − x � ♯ ) • assignment ( X 2 = � y ← x 2 − x � ♯ ( X 1 )) • upper bound (join) ( X 7 = X 6 ∪ X 4 ) • over-approximation of lower bounds (meet) ( X 3 = � y ≥ 0 � ♯ X 2 = “ X 3 = X 2 ∩ � y ≥ 0 � ♯ ⊤ ♯ ” ) • Convergence acceleration (widening) K. Ghorbal (INRIA) 13 SIF M2 13 / 13