Tutorial on Widening (and Narrowing) Hongseok Yang Seoul National University.

Slides:



Advertisements
Similar presentations
Continuing Abstract Interpretation We have seen: 1.How to compile abstract syntax trees into control-flow graphs 2.Lattices, as structures that describe.
Advertisements

Reasoning About Code; Hoare Logic, continued
Regula-Falsi Method. Type of Algorithm (Equation Solver) The Regula-Falsi Method (sometimes called the False Position Method) is a method used to find.
Functions Section 2.3 of Rosen Fall 2008
1 Basic abstract interpretation theory. 2 The general idea §a semantics l any definition style, from a denotational definition to a detailed interpreter.
Worklist algorithm Initialize all d i to the empty set Store all nodes onto a worklist while worklist is not empty: –remove node n from worklist –apply.
61 Nondeterminism and Nodeterministic Automata. 62 The computational machine models that we learned in the class are deterministic in the sense that the.
1 Undecidability Andreas Klappenecker [based on slides by Prof. Welch]
Programming Language Semantics Denotational Semantics Chapter 5 Part II.
From last time: Lattices A lattice is a tuple (S, v, ?, >, t, u ) such that: –(S, v ) is a poset – 8 a 2 S. ? v a – 8 a 2 S. a v > –Every two elements.
CSE115/ENGR160 Discrete Mathematics 02/21/12
Part 3 Truncation Errors.
Abstract Interpretation Part I Mooly Sagiv Textbook: Chapter 4.
Administrative stuff Office hours: After class on Tuesday.
Data Flow Analysis Compiler Design Nov. 8, 2005.
San Diego October 4-7, 2006 Over 1,000 women in computing Events for undergraduates considering careers and graduate school Events for graduate students.
Sequence A list of objects arranged in a particular order.
Recap: Reaching defns algorithm From last time: reaching defns worklist algo We want to avoid using structure of the domain outside of the flow functions.
Notes, part 5. L’Hospital Another useful technique for computing limits is L'Hospital's rule: Basic version: If, then provided the latter exists. This.
1 Program Analysis Systematic Domain Design Mooly Sagiv Tel Aviv University Textbook: Principles.
Programming Language Semantics Denotational Semantics Chapter 5 Part III Based on a lecture by Martin Abadi.
1 Program Analysis Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
1 Tentative Schedule u Today: Theory of abstract interpretation u May 5 Procedures u May 15, Orna Grumberg u May 12 Yom Hatzamaut u May.
Lecture 9 Illustrations Lattices. Fixpoints Abstract Interpretation.
Scientific Computing Algorithm Convergence and Root Finding Methods.
Introduction to CS Theory Lecture 1 – Introduction Piotr Faliszewski
FUNCTION Discrete Mathematics Asst. Prof. Dr. Choopan Rattanapoka.
Solving fixpoint equations
Compiler Construction Lecture 16 Data-Flow Analysis.
The importance of sequences and infinite series in calculus stems from Newton’s idea of representing functions as sums of infinite series.  For instance,
MATH 224 – Discrete Mathematics
Graph Definitions and Applications. Graphs: Very Useful Abstractions Graphs apply to many diverse areas: social sciences, linguistics, physical sciences,
Lecture 10 Abstract Interpretation using Fixpoints.
Functions Reading: Chapter 6 (94 – 107) from the text book 1.
What lies between + and  and beyond? H.P.Williams London School of Economics.
Sequences and Summations Section 2.4. Section Summary Sequences. – Examples: Geometric Progression, Arithmetic Progression Recurrence Relations – Example:
12 INFINITE SEQUENCES AND SERIES. In general, it is difficult to find the exact sum of a series.  We were able to accomplish this for geometric series.
Formalization of DFA using lattices. Recall worklist algorithm let m: map from edge to computed value at edge let worklist: work list of nodes for each.
Program Analysis and Verification Spring 2015 Program Analysis and Verification Lecture 13: Abstract Interpretation V Roman Manevich Ben-Gurion University.
Program Analysis and Verification
Department of Statistics University of Rajshahi, Bangladesh
Program Analysis Mooly Sagiv Tel Aviv University Sunday Scrieber 8 Monday Schrieber.
Main Menu Main Menu (Click on the topics below) Pigeonhole Principle Example Generalized Pigeonhole Principle Example Proof of Pigeonhole Principle Click.
1 Iterative Program Analysis Part II Mathematical Background Mooly Sagiv Tel Aviv University
Chaotic Iterations Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
Chaotic Iterations Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
Chapter 2 1. Chapter Summary Sets The Language of Sets - Sec 2.1 – Lecture 8 Set Operations and Set Identities - Sec 2.2 – Lecture 9 Functions and sequences.
Abstraction and Abstract Interpretation. Abstraction (a simplified view) Abstraction is an effective tool in verification Given a transition system, we.
Abstractions Eric Feron. Outline Principles of abstraction Motivating example Abstracting variables Abstracting functions Abstracting operators Recommended.
1 Abstract interpretation Giorgio Levi Dipartimento di Informatica, Università di Pisa
SEQUENCES A function whose domain is the set of all integers greater than or equal to some integer n 0 is called a sequence. Usually the initial number.
Lub and glb Given a poset (S, · ), and two elements a 2 S and b 2 S, then the: –least upper bound (lub) is an element c such that a · c, b · c, and 8 d.
SECTION 8.3 THE INTEGRAL AND COMPARISON TESTS. P2P28.3 INFINITE SEQUENCES AND SERIES  In general, it is difficult to find the exact sum of a series.
Spring 2017 Program Analysis and Verification
Applied Discrete Mathematics Week 2: Functions and Sequences
Copyright © Cengage Learning. All rights reserved.
Mathematical Induction Recursion
Symbolic Implementation of the Best Transformer
Iterative Program Analysis Abstract Interpretation
Chapter 7 Sampling Distributions.
Program Analysis and Verification
Chapter 7 Sampling Distributions.
Chapter 7 Sampling Distributions.
Lecture 10: Fixed Points ad Infinitum M.C. Escher, Moebius Ants
Formalization of DFA using lattices
Formalization of DFA using lattices
Formalization of DFA using lattices
Formalization of DFA using lattices
Chapter 7 Sampling Distributions.
Presentation transcript:

Tutorial on Widening (and Narrowing) Hongseok Yang Seoul National University

Goal of Abstract Interpretation int P() { int x = 2; while (x >= 0) { // Question: which value can “ x ” have here? x = x + 1; } return(x); } An abstract interpretation answers this question by “executing” a program “abstractly”. The answer is an upper approximation.

Usual Abstract Interpretation x = 2; while (x >= 0) {/* i 2 I */ x = x+1;} First, define a finite lattice >. Each element of L denotes a set of integers that “x” can have in the loop. Second, define a monotone function F:L ! L. F is the abstraction of the loop body. Finally, compute the least fixpoint fix(F). fix(F) is the limit of ?, F( ? ), F 2 ( ? ), … Since L is finite and F n ( ? ) is increasing, the sequence “terminates”. Example: L = { ?, +, 0, -, > } and F(X) = (+ t (X © +))

Infinite Abstract Domain Question: Can we use an infinite lattice L? Using a larger L, we can obtain a better estimate of a program invariant. But, fix(F) might not be computable. Answer: Yes, we can, if we have widening. Intuitively, widening works by picking a different finite subset of L for each program F.

Goal of this Talk My goal is to demystify widening and narrowing: 1. What are widening and narrowing? 2. How do they allow us to use an infinite lattice? 3. How to design widening and narrowing? 4. Are they really necessary? Can we just live with finite lattices, or lattices with no strictly increasing chain? I’ll mostly focus on widening.

Problem Mathematically Question: Given an infinite lattice > and monotone F:L ! L, compute fix(F). ?, F( ? ), F 2 ( ? ), … converges to fix(F). But, the sequence might strictly increase. Widening approach asks a different question: Find an upper approximation “a” of fix(F), fix(F) v a. 1. First, approximate the sequence {F n ( ? )} by a “terminating” sequence {a n }: F n ( ? ) v a n. 2. Then, compute the limit “a” of {a n }.

Widening “ r : L £ L ! L” General Dfn: Widening is what gives us {a n } for every F. For every monotone function F, the below sequence {a n } approximates {F n ( ? )} and terminates: a 0 = ? a n+1 = a n r F(a n ) Specific Dfn: Widening r : L £ L ! L is a function s.t. 1. x v x r y and y v x r y; and 2. for all increasing sequences {x n } n, the “widened” sequence y n terminates: y 0 = x 0 y n+1 = y n r x n+1

Widening fix(F) a ? F( ? ) a1a1 F2(?)F2(?) F3(?)F3(?) a2a2 a3a3 a0a0 F(a 0 ) F(a 1 ) F(a 2 )

Example Find fix(F) in the interval domain L: L = { ? } [ {[l,u] | l,u 2 (Z [ {-inf,inf}) Æ l · u} F(X) = [0,0] t (X + [1,1]) F n ( ? ) = [0,n-1]. Thus, {F n ( ? )} is strictly increasing. Use the following widening r : [l,u] r ? = ? r [l,u] = [l,u] [l,u] r [l’,u’] = [if l’ u then inf else u] What is the limit of {a n }?

Technique for Designing Widening For each non-bottom x ( != ? ), decide a finite lattice L x ( µ L), and define (x r -) as an “abstraction” fn from L to L x. (x r -) : L ­ L x : id Then, define ?r x = x. Example: for r in the previous slide, L [l,u] = { ?, [l,u], [l,inf], [-inf,u], [-inf,inf]} This kind of widening lets us pick a different finite subset L F( ? ) for each F. Exercise: F(X) = ([1,1] t (X + [-1,1])) u [-inf,4]. Design a widening whose “a” for F is [-inf,4].

Finite Domain on the Fly (My Observation) Suppose that for each non-bottom x ( != ? ), there is a subset L x of L such that 1. L x with the order of L is a lattice with finite height; 2. “  x : L ­ L x : id” is a Galois embedding; and   x (x) = x = ? x. Proposition1: If for all x and all y in L x, L y µ L x, then “u r w =  u (w)” and “ ?r w = w” define a widening operator. Proposition2: Moreover, if for all x and y in L x,  y (z) =  x (z) t x y, then for every non-strict monotone function F, this widening picks L F( ? ) in the computation: the n+1-th term a n+1 of the widened sequence is the n-th iterate of (  F( ? ) o F): L F( ? ) ! L F( ? ).

Widening Sequence { r i } Is there a widening that uses F k ( ? ) to decide a finite subset for F? Need to use different “widening” r i for a i. For every monotone function F, the below sequence {a n } approximates {F n ( ? )} and terminates: a 0 = ? a n+1 = a n r n F(a n ) A widening sequence { r n } is a sequence of fns s.t. 1. x v x r n y and y v x r n y; and 2. for all increasing sequences {x n } n, the “widened” sequence y n terminates: y 0 = x 0 y n+1 = y n r n x n+1 Design Technique: Usually, r 0 =…= r k-1 = t, and r k = r k+1 =… Exercise: F(X) = ([1,1] t (X + [-10,10])) u [-inf,30].

Increase the Precision Problem: Suppose we obtained an approximation “a” of fix(F) via widening. From “a”, find a more precise approximation. Not-computable “solution”: a, F(a), F 2 (a), F 3 (a), … For each n, fix(F) v F n (a) and F n+1 v F n (a). ( * a w F(a)) Narrowing approach: 1. Approximate the sequence {F n (a)} by a “terminating” decreasing sequence {b n }: F n (a) v b n. 2. Then, b is the limit of {b n }.

Narrowing a b1b1 b2b2 b3b3 b4b4 F 1 (a) F 2 (a) F 4 (a) F 3 (a) fix(F) b F(b 0 ) F(b 3 ) b0b0 F(b 2 ) F(b 1 )

Narrowing General Dfn: Narrowing is what gives us {b n } for every F. For every monotone function F, the below sequence {b n } approximates {F n (a)}, is decreasing and terminates: b 0 = ab n+1 = b n r F(b n ) Specific Dfn: Narrowing  : L £ L ! L is a function such that 1. x w x  y w y, and 2. for all decreasing sequences {x n } n, the “narrowed” sequence {y n } terminates: y 0 = x 0 y n+1 = y n  x n+1

Widening/Narrowing Example F(X) = ([1,1] t (X+[1,1])) u [-inf,100] Widening: ?r x = x r? = ? [l,u] r [l’,u’] = [if l > l’ then -inf else l, if u < u’ then inf else u] Narrowing: ?  x = x  ? = ? [l,u]  [l’,u’] = [if l = -inf then l’ else l, if u = inf then u’ else u] Exercise: Compute an approximation of fix(F).

Finite Lattices Are Not as Powerful as Widening. int P nm () { int i = n; while (i <= m) { // i 2 [n,m] i := i + 1; } return(i); } With a single “finite” abstract domain, we cannot find the invariant of “ P nm () ” for all n and m. {[n,m] | n · m} has a strictly increasing sequence. We can find the invariant of all “ P nm () ”s, using the interval domain and the widening and narrowing in the previous slide.

Conclusion Widening lets us use an infinite lattice in designing an abstract interpreter. It picks a finite subset depending on an input program. A common technique for designing widening is to compute F k ( ? ) for some fixed k, and to use the result to build a finite subset. Why don’t you design an abstract interpreter based on an infinite lattice and widening?