Weakly-relational shapes for numeric abstractions: improved algorithms and proofs of correctness

Abstract

Weakly-relational numeric constraints provide a compromise between complexity and expressivity that is adequate for several applications in the field of formal analysis and verification of software and hardware systems. We address the problems to be solved for the construction of full-fledged, efficient and provably correct abstract domains based on such constraints. We first propose to work with semantic abstract domains, whose elements are geometric shapes, instead of the (more concrete) syntactic abstract domains of constraint networks and matrices on which the previous proposals are based. This allows to solve, once and for all, the problem whereby closure by entailment, a crucial operation for the realization of such domains, seemed to impede the realization of proper widening operators. In our approach, the implementation of widenings relies on the availability of an effective reduction procedure for the considered constraint description: one for the domain of bounded difference shapes already exists in the literature; we provide algorithms for the significantly more complex cases of rational and integer octagonal shapes. We also improve upon the state-of-the-art by presenting, along with their proof of correctness, closure by entailment algorithms of reduced complexity for domains based on rational and integer octagonal constraints. The consequences of implementing weakly-relational numerical domains with floating point numbers are also discussed.

Transfer Function Synthesis without Quantifier Elimination

“…Intuitively, this means that all hyperplanes defined through inequalities actually touch the enclosed volume. However, the octagons may contain redundant inequalities, and therefore it will be interesting to see if simplification is worthwhile [2] and, if so, whether nonredundant octagons can be directly derived using SAT.…”

Tutorial on Static Inference of Numeric Invariants by Abstract Interpretation

“…5.3.4), we have a representation-aware widening. A more semantic widening, that is independent from the DBM chosen to represent the zone arguments, has been proposed by Bagnara et al [2009], based on an alternate normal form that tries to remove as many constraints as possible (i.e., put bounds to +∞).…”

“…The efficiency of these domains has then been improved, firstly through algorithmic improvements, by Bagnara et al [2008a] and Bagnara et al [2009] and, secondly, through implementation improvements, such as leveraging the parallel execution available in GPU by Banterle and Giacobazzi [2007]. Alternate weakly relational domains, also based on transitive closure algorithms, include the less expressive pentagon domain by Logozzo and Fähndrich [2010] and the more expressive "Two variables per inequality" domain by .…”

Compact Difference Bound Matrices

“…The Octagon domain [18] is a widely deployed [6] abstract domain, whose popularity stems from the polynomial complexity of its domain operations [2,9,18] and ease of implementation [13]. Systems of octagon constraints are conventionally represented [18] using difference bound matrices (DBMs).…”

“…Running Callgrind [25] on an off-the-shelf abstract interpreter (EVA [8]), equipped with the de-facto implementation of Octagons (Apron [13]) on AES-128 code (taes of table 1) revealed that 36% of all the function calls emanated from qmpq init which merely allocates memory and initialises the state of a rational number. When working over rationals, these indirect costs dampen or mask algorithmic improvements obtained by refactoring [2] and reformulating [9] domain operations.…”