[PPT] - SMT-Style Program Analysis with Value-based Refinements Vijay PowerPoint Presentation

SLIDE 1

SMT-Style Program Analysis

SMT-Style Program Analysis with Value-based Refinements

Vijay D’Silva Leopold Haller Daniel Kr¨

ning

NSV-3 July 15, 2010

SLIDE 2

SMT-Style Program Analysis

Outline

Imprecision and Refinement in Abstract Interpretation SAT Style Abstract Analysis Value-based Refinement for Intervals

SLIDE 3

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecision in Abstract Interpretation

◮ Abstract interpretation sound but not complete. ◮ Incompleteness manifests in imprecision during the analysis.

SLIDE 4

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecision in Abstract Interpretation

◮ Abstract interpretation sound but not complete. ◮ Incompleteness manifests in imprecision during the analysis.

⊥ [1, 1] [2, 2] [3, 3] [1, 2] [2, 3] [1, 3] ⊤ Example: Domain of Intervals

SLIDE 5

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Domain

Imprecision in join x:=*; if(x > 5) y := -1; else y := 1; assert(y != 0);

SLIDE 6

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Domain

Imprecision in join x:=*; if(x > 5) y := -1; else y := 1; assert(y != 0);

y ∈ [−1, −1], x ∈ [6, ∞]

SLIDE 7

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Domain

Imprecision in join x:=*; if(x > 5) y := -1; else y := 1; assert(y != 0);

y ∈ [−1, −1], x ∈ [6, ∞] y ∈ [1, 1], x ∈ [−∞, 5]

SLIDE 8

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Domain

Imprecision in join x:=*; if(x > 5) y := -1; else y := 1; assert(y != 0);

y ∈ [−1, −1], x ∈ [6, ∞] y ∈ [1, 1], x ∈ [−∞, 5] y ∈ [−1, 1]

The disjunction y = 1 ∨ y = −1 cannot be expressed as an interval.

SLIDE 9

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Domain

Imprecision in transformer x:=y; if(x > 5) assert(y > 5);

SLIDE 10

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Domain

Imprecision in transformer x:=y; if(x > 5) assert(y > 5); ⊤

SLIDE 11

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Domain

Imprecision in transformer x:=y; if(x > 5) assert(y > 5); ⊤ x ∈ [6, ∞]

SLIDE 12

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Domain

Imprecision in transformer x:=y; if(x > 5) assert(y > 5); ⊤ x ∈ [6, ∞] Intervals cannot express relational information.

SLIDE 13

SMT-Style Program Analysis Imprecision and Refinement in AI

Imprecisions in the Analysis

Imprecision in widening while(x < 50000) { x++; if(y < x) y++; }

x ∈ [0, 0], y ∈ [0, 0] x ∈ [0, 1], y ∈ [0, 1] widening x ∈ [0, ∞], y ∈ [0, ∞] x ∈ [50000, 50000], y ∈ [0, ∞]

Precision can be lost in the the analysis Refinement of widening studied by, e.g., Gulavani et. al (TACAS 2008), Wang et al. (CAV 2007)

SLIDE 14

SMT-Style Program Analysis Imprecision and Refinement in AI

Refining Abstract Domains

Global domain refinement

SLIDE 15

SMT-Style Program Analysis Imprecision and Refinement in AI

Refining Abstract Domains

Global domain refinement More powerful domain Octagons Polyhedra . . .

SLIDE 16

SMT-Style Program Analysis Imprecision and Refinement in AI

Refining Abstract Domains

Global domain refinement More powerful domain Octagons Polyhedra . . . Disjunctive completion ⊤ ≤ 0 = 0 ≥ 0 − + ⊥

SLIDE 17

SMT-Style Program Analysis Imprecision and Refinement in AI

Refining Abstract Domains

Global domain refinement More powerful domain Octagons Polyhedra . . . Disjunctive completion ⊤ ≤ 0 = 0 ≥ 0 − + ⊥ Reduced product Cardinal power

◮ Global refinements potentially expensive. ◮ How can we locally refine an abstract domain?

SLIDE 18

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Trace partitioning allows for flexible and local refinement

SLIDE 19

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Trace partitioning allows for flexible and local refinement

◮ Consider separately different sets of traces through a program ◮ Similar to case splits in a mathematical proof.

SLIDE 20

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Trace partitioning allows for flexible and local refinement

◮ Consider separately different sets of traces through a program ◮ Similar to case splits in a mathematical proof.

Control-flow based trace partitioning

x := * [x > 5] [x <= 5] y := 1 y := -1 assert(y != 0)

SLIDE 21

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Trace partitioning allows for flexible and local refinement

◮ Consider separately different sets of traces through a program ◮ Similar to case splits in a mathematical proof.

Control-flow based trace partitioning

x := * [x > 5] [x <= 5] y := 1 y := -1 assert(y != 0)

y = −1

SLIDE 22

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Trace partitioning allows for flexible and local refinement

◮ Consider separately different sets of traces through a program ◮ Similar to case splits in a mathematical proof.

Control-flow based trace partitioning

x := * [x > 5] [x <= 5] y := 1 y := -1 assert(y != 0)

y = −1 y = 1

SLIDE 23

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Wide range of partitionings possible

◮ control flow, ◮ values of variables, ◮ number of iterations through a loop, etc.

SLIDE 24

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Wide range of partitionings possible

◮ control flow, ◮ values of variables, ◮ number of iterations through a loop, etc.

Value-based partitioning x:=y; if(x > 5) assert(y > 5);

SLIDE 25

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Wide range of partitionings possible

◮ control flow, ◮ values of variables, ◮ number of iterations through a loop, etc.

Value-based partitioning x:=y; if(x > 5) assert(y > 5); assume(y > 5);

y > 5

SLIDE 26

SMT-Style Program Analysis Imprecision and Refinement in AI

Trace Partitioning

◮ Wide range of partitionings possible

◮ control flow, ◮ values of variables, ◮ number of iterations through a loop, etc.

Value-based partitioning x:=y; if(x > 5) assert(y > 5); assume(y > 5);

y > 5

assume(y <= 5);

⊥

SLIDE 27

SMT-Style Program Analysis Imprecision and Refinement in AI

Finding Partitioning Functions

◮ Trace partitioning allows one to refine the precision of an analysis

down to explicit exploration of all traces.

SLIDE 28

SMT-Style Program Analysis Imprecision and Refinement in AI

Finding Partitioning Functions

◮ Trace partitioning allows one to refine the precision of an analysis

down to explicit exploration of all traces. The main question is:

SLIDE 29

SMT-Style Program Analysis Imprecision and Refinement in AI

Finding Partitioning Functions

◮ Trace partitioning allows one to refine the precision of an analysis

down to explicit exploration of all traces. The main question is: How can we find a good partitioning?

SLIDE 30

SMT-Style Program Analysis Imprecision and Refinement in AI

Finding Partitioning Functions

◮ Trace partitioning allows one to refine the precision of an analysis

down to explicit exploration of all traces. The main question is: How can we find a good partitioning?

◮ Precise enough to prove the property, and ◮ abstract enough to be efficient.

SLIDE 31

SMT-Style Program Analysis Imprecision and Refinement in AI

Finding Partitioning Functions

◮ Leino and Logozzo (APLAS 2005): Value-based trace partitionings

based on counter examples

◮ Gulavani et al. (TACAS 2008): DAG-based Exploration of

control-flow paths inside loops with splitting on demand.

◮ Gulwani et al. (PLDI 2009): Control-flow refinement for bounds

analysis.

◮ Harris et al. (POPL 2010): Satisfiability Modulo Path Programs

SLIDE 32

SMT-Style Program Analysis SAT Style Abstract Analysis

Value-based Trace Partitionings

◮ If the abstract transformer ˆ

F is too imprecise, find a set of transformers ˆ F1, . . . , ˆ Fk, such that

1≤i≤k

γ(µX. ˆ Fi(X)) ⊇ µX. F(X)

SLIDE 33

SMT-Style Program Analysis SAT Style Abstract Analysis

Value-based Trace Partitionings

◮ If the abstract transformer ˆ

F is too imprecise, find a set of transformers ˆ F1, . . . , ˆ Fk, such that

1≤i≤k

γ(µX. ˆ Fi(X)) ⊇ µX. F(X)

◮ This can be done by clipping the analysis by an abstract element:

ˆ Fi = ˆ F ⊓ ai

SLIDE 34

SMT-Style Program Analysis SAT Style Abstract Analysis

Value-based Trace Partitionings

◮ If the abstract transformer ˆ

F is too imprecise, find a set of transformers ˆ F1, . . . , ˆ Fk, such that

1≤i≤k

γ(µX. ˆ Fi(X)) ⊇ µX. F(X)

◮ This can be done by clipping the analysis by an abstract element:

ˆ Fi = ˆ F ⊓ ai

SLIDE 35

SMT-Style Program Analysis SAT Style Abstract Analysis

Value-based Trace Partitionings

◮ If the abstract transformer ˆ

F is too imprecise, find a set of transformers ˆ F1, . . . , ˆ Fk, such that

1≤i≤k

γ(µX. ˆ Fi(X)) ⊇ µX. F(X)

◮ This can be done by clipping the analysis by an abstract element:

ˆ Fi = ˆ F ⊓ ai

+

SLIDE 36

SMT-Style Program Analysis SAT Style Abstract Analysis

Value-based Trace Partitionings

◮ If the abstract transformer ˆ

F is too imprecise, find a set of transformers ˆ F1, . . . , ˆ Fk, such that

1≤i≤k

γ(µX. ˆ Fi(X)) ⊇ µX. F(X)

◮ This can be done by clipping the analysis by an abstract element:

ˆ Fi = ˆ F ⊓ ai

+ =

SLIDE 37

SMT-Style Program Analysis SAT Style Abstract Analysis

Value-based Trace Partitionings

New question:

SLIDE 38

SMT-Style Program Analysis SAT Style Abstract Analysis

Value-based Trace Partitionings

New question: How can we find such a set of elements a1, . . . , ak?

SLIDE 39

SMT-Style Program Analysis SAT Style Abstract Analysis

Value-based Trace Partitionings

New question: How can we find such a set of elements a1, . . . , ak? Use the search architecture of a SAT solver!

SLIDE 40

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL framework

DPLL procedure

decide propagate Conflict learn backtrack

SLIDE 41

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL framework

DPLL procedure

decide propagate Conflict learn backtrack

◮ Main phases of the DPLL procedure:

SLIDE 42

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL framework

DPLL procedure

decide propagate Conflict learn backtrack

◮ Main phases of the DPLL procedure:

Decision Assume a value for an undetermined variable

SLIDE 43

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL framework

DPLL procedure

decide propagate Conflict learn backtrack

◮ Main phases of the DPLL procedure:

Decision Assume a value for an undetermined variable Propagation Deduce implied variable values

SLIDE 44

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL framework

DPLL procedure

decide propagate Conflict learn backtrack

◮ Main phases of the DPLL procedure:

Decision Assume a value for an undetermined variable Propagation Deduce implied variable values Learning Learn reason for conflict and backtrack

SLIDE 45

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL framework

DPLL procedure

decide propagate Conflict learn backtrack

◮ Main phases of the DPLL procedure:

Decision Assume a value for an undetermined variable Propagation Deduce implied variable values Learning Learn reason for conflict and backtrack

SLIDE 46

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL Procedure

Is φ(x, y, z) satisfiable?

SLIDE 47

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL Procedure

Decision Is φ(x, y, z) satisfiable? x = 1

SLIDE 48

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL Procedure

Propagation Is φ(x, y, z) satisfiable? x = 1 z = 0

SLIDE 49

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL Procedure

Decision Is φ(x, y, z) satisfiable? x = 1 z = 0 y = 1

SLIDE 50

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL Procedure

Propagation Is φ(x, y, z) satisfiable? x = 1 z = 0 y = 1 z = 1

SLIDE 51

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL Procedure

Propagation Is φ(x, y, z) satisfiable? x = 1 z = 0 y = 1 z = 1 Conflict

SLIDE 52

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL Procedure

Learning Is φ(x, y, z) satisfiable? x = 1 z = 0 y = 1 z = 1

SLIDE 53

SMT-Style Program Analysis SAT Style Abstract Analysis

DPLL Procedure

Learning Is φ(x, y, z) satisfiable? x = 0

SLIDE 54

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

decide clipped fixpoint Safety proven generalize backtrack

SLIDE 55

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

decide clipped fixpoint Safety proven generalize backtrack Decision Refine current element a by a′ ⊏ a

SLIDE 56

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

decide clipped fixpoint Safety proven generalize backtrack Decision Refine current element a by a′ ⊏ a Propagation Compute clipped fixpoint µX. ˆ T(X) ⊓ a′

SLIDE 57

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

decide clipped fixpoint Safety proven generalize backtrack Decision Refine current element a by a′ ⊏ a Propagation Compute clipped fixpoint µX. ˆ T(X) ⊓ a′ Learning Find a′′ ⊒ a′, such that µX.ˆ F(X) ⊓ a′′ is safe.

SLIDE 58

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Decision ⊤ Initially, a = ⊤

SLIDE 59

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Propagation ⊤ Initially, a = ⊤ µX.ˆ F(X) not safe

SLIDE 60

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Decision ⊤ A1 Decision: refine a

SLIDE 61

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Propagation ⊤ A1 Decision: refine a µX.(ˆ F(X) ⊓ A1) not safe

SLIDE 62

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Decision ⊤ A1 B2 Decision: refine a

SLIDE 63

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Propagation ⊤ A1 B2 Decision: refine a µX.(ˆ F(X) ⊓ B2) safe

SLIDE 64

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Generalization A1 B2

SLIDE 65

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Generalization A1 B2 A2 µX.ˆ F(X) ⊓ A2 safe

SLIDE 66

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Generalization A1 B2 A2 µX.ˆ F(X) ⊓ A2 safe

SLIDE 67

SMT-Style Program Analysis SAT Style Abstract Analysis

SAT-Style Program Analysis

⊤ A1 A2 A3 A4 B1 B2 B3 B4 B5 C1 C2 C3 C4 ⊥ Generalization A1 A2 B2 B3 C1 C2 C3 ⊥ Backtrack and continue

SLIDE 68

SMT-Style Program Analysis SAT Style Abstract Analysis

Comments on Analysis

◮ When can we efficiently prove safety with this?

SLIDE 69

SMT-Style Program Analysis SAT Style Abstract Analysis

Comments on Analysis

◮ When can we efficiently prove safety with this?

◮ When there is a small and finite number of elements a1, . . . , ak

such that the fixpoints µX.(ˆ F(X) ⊓ ai) can be put together to form a concrete postfixpoint.

SLIDE 70

SMT-Style Program Analysis SAT Style Abstract Analysis

Comments on Analysis

◮ When can we efficiently prove safety with this?

◮ When there is a small and finite number of elements a1, . . . , ak

such that the fixpoints µX.(ˆ F(X) ⊓ ai) can be put together to form a concrete postfixpoint.

◮ Specific implementation issues:

◮ Generalization step ◮ Decision heuristic

SLIDE 71

SMT-Style Program Analysis Value-based Refinement for Intervals

Value-based Refinement for Intervals

We have created a preliminary instantiation of this framework for the domain of intervals.

SLIDE 72

SMT-Style Program Analysis Value-based Refinement for Intervals

Value-based Refinement for Intervals

We have created a preliminary instantiation of this framework for the domain of intervals. Decision: Choose an initial assignment for all variables

SLIDE 73

SMT-Style Program Analysis Value-based Refinement for Intervals

Value-based Refinement for Intervals

We have created a preliminary instantiation of this framework for the domain of intervals. Decision: Choose an initial assignment for all variables Propagation: Compute forward interpretation for this initial value

SLIDE 74

SMT-Style Program Analysis Value-based Refinement for Intervals

Value-based Refinement for Intervals

We have created a preliminary instantiation of this framework for the domain of intervals. Decision: Choose an initial assignment for all variables Propagation: Compute forward interpretation for this initial value Generalization and Learning: Generalize the result by locally generalizing intervals. Re- move generalized initial values from selection pool

SLIDE 75

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Decision [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); Choose initial: x = 0, y = 0

SLIDE 76

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Propagation [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); Choose initial: x = 0, y = 0 x = 0, y = 0 ⊥ x = 0, y = 1 x = 0, y = 1

SLIDE 77

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Generalization [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); Choose initial: x = 0, y = 0 x = 0, y = 0 ⊥ x = 0, y = 1 ⊤

SLIDE 78

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Generalization [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); Choose initial: x = 0, y = 0 x = 0, y = 0 ⊥ ⊤ y > 0

SLIDE 79

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Generalization [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); Choose initial: x = 0, y = 0 x = 0, y = 0 ⊤ y > 0 ⊥

SLIDE 80

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Generalization [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); Choose initial: x = 0, y = 0 ⊤ y > 0 ⊥ ⊤

SLIDE 81

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Generalization [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); ⊤ y > 0 ⊥ ⊤ Generalized init: x ≤ 5

SLIDE 82

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Decision [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); ¬ x ≤ 5 Choose initial: x = 8, y = 0

SLIDE 83

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Propagation [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); ¬ x ≤ 5 Choose initial: x = 8, y = 0 ⊥ x = 8, y = 0 x = 8, y = −1 x = 8, y = −1

SLIDE 84

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Generalization [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); ¬ x ≤ 5 Generalized init: x > 5 ⊥ ⊤ y < 0 ⊤

SLIDE 85

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 1

Generalization [x > 5] [x<= 5] y:=-1 y:=1 assert(y!=0); ¬ x ≤ 5 ¬ x > 5

SLIDE 86

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 2

Decision

x:=y [x<5] assert(y<5) [x>=5]

x = 0, y = 1

SLIDE 87

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 2

Propagation

x:=y [x<5] assert(y<5) [x>=5]

x = 0, y = 1 x = 1, y = 1 x = 1, y = 1 x = 1, y = 1

SLIDE 88

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 2

Generalization

x:=y [x<5] assert(y<5) [x>=5]

Generalized init: y < 5 y < 5 y < 5 ⊤

SLIDE 89

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 2

Generalization

x:=y [x<5] assert(y<5) [x>=5]

¬y < 5

SLIDE 90

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 2

Decision

x:=y [x<5] assert(y<5) [x>=5]

¬y < 5 x = 0, y = 6

SLIDE 91

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 2

Propagation

x:=y [x<5] assert(y<5) [x>=5]

¬y < 5 x = 0, y = 6 x = 6, y = 6 ⊥ x = 6, y = 6

SLIDE 92

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 2

Generalization

x:=y [x<5] assert(y<5) [x>=5]

¬y < 5 Generalized init: y ≥ 5 x ≥ 5 y < 5 ⊤

SLIDE 93

SMT-Style Program Analysis Value-based Refinement for Intervals

Example 2

x:=y [x<5] assert(y<5) [x>=5]

¬y < 5 ¬y ≥ 5

SLIDE 94

SMT-Style Program Analysis Value-based Refinement for Intervals

Notes on Implementation

◮ Initial values chosen by call to a SAT solver.

SLIDE 95

SMT-Style Program Analysis Value-based Refinement for Intervals

Notes on Implementation

◮ Initial values chosen by call to a SAT solver. ◮ Generalization uses local repair (SMPP):

◮ Set every location to ⊤ ◮ For each invalid triple {pre} stmt {post} ◮ repair with {pre} from forward analysis. ◮ generalize using search on bounds.

SLIDE 96

SMT-Style Program Analysis Value-based Refinement for Intervals

Notes on Implementation

◮ Initial values chosen by call to a SAT solver. ◮ Generalization uses local repair (SMPP):

◮ Set every location to ⊤ ◮ For each invalid triple {pre} stmt {post} ◮ repair with {pre} from forward analysis. ◮ generalize using search on bounds.

◮ Generalization step:

0 ≤ a ≤ 5, b > 5, c < 10 Repair using SAT solver assert(a <= 10 || a >= -10) b > 5

SLIDE 97

SMT-Style Program Analysis Value-based Refinement for Intervals

Notes on Implementation

◮ Initial values chosen by call to a SAT solver. ◮ Generalization uses local repair (SMPP):

◮ Set every location to ⊤ ◮ For each invalid triple {pre} stmt {post} ◮ repair with {pre} from forward analysis. ◮ generalize using search on bounds.

◮ Generalization step:

Repair using SAT solver 0 ≤ a ≤ 5, b > 5, c < 10 Increase bounds by search assert(a <= 10 || a >= -10) b > 5

SLIDE 98

SMT-Style Program Analysis Value-based Refinement for Intervals

Notes on Implementation

◮ Initial values chosen by call to a SAT solver. ◮ Generalization uses local repair (SMPP):

◮ Set every location to ⊤ ◮ For each invalid triple {pre} stmt {post} ◮ repair with {pre} from forward analysis. ◮ generalize using search on bounds.

◮ Generalization step:

Repair using SAT solver Increase bounds by search 0 ≤ a ≤ ∞, b > 5, c < 10 assert(a <= 10 || a >= -10) b > 5

SLIDE 99

SMT-Style Program Analysis Value-based Refinement for Intervals

Notes on Implementation

◮ Initial values chosen by call to a SAT solver. ◮ Generalization uses local repair (SMPP):

◮ Set every location to ⊤ ◮ For each invalid triple {pre} stmt {post} ◮ repair with {pre} from forward analysis. ◮ generalize using search on bounds.

◮ Generalization step:

Repair using SAT solver Increase bounds by search 0 ≤ a ≤ ∞, b > 5, c < 10 assert(a <= 10 || a >= -10) b > 5

SLIDE 100

SMT-Style Program Analysis Value-based Refinement for Intervals

Notes on Implementation

◮ Initial values chosen by call to a SAT solver. ◮ Generalization uses local repair (SMPP):

◮ Set every location to ⊤ ◮ For each invalid triple {pre} stmt {post} ◮ repair with {pre} from forward analysis. ◮ generalize using search on bounds.

◮ Generalization step:

Repair using SAT solver Increase bounds by search −10 ≤ a ≤ ∞, b > 5, c < 10 assert(a <= 10 || a >= -10) b > 5

SLIDE 101

SMT-Style Program Analysis Value-based Refinement for Intervals

Preliminary benchmarks

◮ Selection of NEC Small Static Analysis Benchmarks (slightly

modified)

◮ Interval analysis too imprecise in all cases

SLIDE 102

SMT-Style Program Analysis Value-based Refinement for Intervals

Preliminary benchmarks

◮ Selection of NEC Small Static Analysis Benchmarks (slightly

modified)

◮ Interval analysis too imprecise in all cases

Inst. # paths (SCC-decomp.) runtime (s) iterations inf1.c 36 * * inf2.c 12 0.7 5 inf3.c 16 0.9 4 inf4.c 1080 * * inf5.c 28 2.1 19 inf6.c 32 0.9 4 inf7.c 27 1.7 7 inf8.c 40 3.3 9

SLIDE 103

SMT-Style Program Analysis Value-based Refinement for Intervals

Preliminary benchmarks

◮ Selection of NEC Small Static Analysis Benchmarks (slightly

modified)

◮ Interval analysis too imprecise in all cases

Inst. # paths (SCC-decomp.) runtime (s) iterations inf1.c 36 * * inf2.c 12 0.7 5 inf3.c 16 0.9 4 inf4.c 1080 * * inf5.c 28 2.1 19 inf6.c 32 0.9 4 inf7.c 27 1.7 7 inf8.c 40 3.3 9

◮ Does not work if fully relational information is required

(inf1.c,inf4.c) assume(x > y); assert(x > y);

SLIDE 104

SMT-Style Program Analysis Value-based Refinement for Intervals

Current Work

◮ Extending the prototype into a tool

SLIDE 105

SMT-Style Program Analysis Value-based Refinement for Intervals

Current Work

◮ Extending the prototype into a tool ◮ Move towards a fully SAT-style analyzer

SLIDE 106

SMT-Style Program Analysis Value-based Refinement for Intervals

Current Work

◮ Extending the prototype into a tool ◮ Move towards a fully SAT-style analyzer ◮ Handling of floating-point numbers

SLIDE 107

SMT-Style Program Analysis Value-based Refinement for Intervals

Current Work

◮ Extending the prototype into a tool ◮ Move towards a fully SAT-style analyzer ◮ Handling of floating-point numbers ◮ Move to more powerful domains

SLIDE 108

SMT-Style Program Analysis Value-based Refinement for Intervals

Current Work

◮ Extending the prototype into a tool ◮ Move towards a fully SAT-style analyzer ◮ Handling of floating-point numbers ◮ Move to more powerful domains ◮ Use trace partitioning and SMT/SAT-style analysis as “glue“ to