1 Systematic Domain Design Some Remarks. 2 Best (Conservative) interpretation abstract representation Set of states concretization Abstract semantics.

Slides:



Advertisements
Similar presentations
Fixed Points and The Fixed Point Algorithm. Fixed Points A fixed point for a function f(x) is a value x 0 in the domain of the function such that f(x.
Advertisements

Abstract Interpretation Part II
Determinacy Inference for Logic Programs Lunjin Oakland University In collaboration with Andy Kent University, UK.
3-Valued Logic Analyzer (TVP) Tal Lev-Ami and Mooly Sagiv.
1 How to transform an analyzer into a verifier. 2 OUTLINE OF THE LECTURE a verification technique which combines abstract interpretation and Park’s fixpoint.
Tutorial on Widening (and Narrowing) Hongseok Yang Seoul National University.
1 Basic abstract interpretation theory. 2 The general idea §a semantics l any definition style, from a denotational definition to a detailed interpreter.
Correctness. Until now We’ve seen how to define dataflow analyses How do we know our analyses are correct? We could reason about each individual analysis.
1 Iterative Program Analysis Part I Mooly Sagiv Tel Aviv University Textbook: Principles of Program.
From last time: Lattices A lattice is a tuple (S, v, ?, >, t, u ) such that: –(S, v ) is a poset – 8 a 2 S. ? v a – 8 a 2 S. a v > –Every two elements.
1 Control Flow Analysis Mooly Sagiv Tel Aviv University Textbook Chapter 3
1 Iterative Program Analysis Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
Abstract Interpretation Part I Mooly Sagiv Textbook: Chapter 4.
1 Program Analysis Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
Recap: Reaching defns algorithm From last time: reaching defns worklist algo We want to avoid using structure of the domain outside of the flow functions.
1 Program Analysis Systematic Domain Design Mooly Sagiv Tel Aviv University Textbook: Principles.
Prof. Aiken CS 294 Lecture 21 Abstract Interpretation Part 2.
Given Connections Solution
Program Analysis Mooly Sagiv Tel Aviv University Sunday Scrieber 8 Monday Schrieber.
Composing Dataflow Analyses and Transformations Sorin Lerner (University of Washington) David Grove (IBM T.J. Watson) Craig Chambers (University of Washington)
November 18, 2004 Conservative Approximations for Heterogeneous Design Roberto Passerone Alessandro Pinto Jerry R. Burch Alberto Sangiovanni Vincentelli.
1 Program Analysis Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
Representing Functions by Power Series. A power series is said to represent a function f with a domain equal to the interval I of convergence of the series.
1 Tentative Schedule u Today: Theory of abstract interpretation u May 5 Procedures u May 15, Orna Grumberg u May 12 Yom Hatzamaut u May.
Program Analysis and Verification Noam Rinetzky Lecture 10: Shape Analysis 1 Slides credit: Roman Manevich, Mooly Sagiv, Eran Yahav.
Abstraction Interpretation Abstract Interpretation is a general theory for approximating the semantics of dynamic systems (Cousot & Cousot 1977) Abstract.
1 Iterative Program Analysis Abstract Interpretation Mooly Sagiv Tel Aviv University Textbook:
Program Analysis and Verification Spring 2014 Program Analysis and Verification Lecture 11: Abstract Interpretation III Roman Manevich Ben-Gurion University.
91587 Mathematics and Statistics Apply systems of simultaneous equations in solving problems Level 3 Credits 2 Assessment Internal.
Program Analysis and Verification Spring 2015 Program Analysis and Verification Lecture 14: Numerical Abstractions Roman Manevich Ben-Gurion University.
Program Analysis and Verification Spring 2014 Program Analysis and Verification Lecture 14: Numerical Abstractions Roman Manevich Ben-Gurion University.
Program Analysis and Verification Spring 2015 Program Analysis and Verification Lecture 9: Abstract Interpretation I Roman Manevich Ben-Gurion University.
Lecture 10 Abstract Interpretation using Fixpoints.
ARTIFICIAL INTELLIGENCE [INTELLIGENT AGENTS PARADIGM] Professor Janis Grundspenkis Riga Technical University Faculty of Computer Science and Information.
Compound Absolute Values Equalities and Inequalities More than one absolute value in the equation.
PROBABILISTIC PROGRAMMING FOR SECURITY Michael Hicks Piotr (Peter) Mardziel University of Maryland, College Park Stephen Magill Galois Michael Hicks UMD.
Featherweight X10: A Core Calculus for Async-Finish Parallelism Jonathan K. Lee, Jens Palsberg Presented By- Vasvi Kakkad.
Application to the automatic extraction of circuit shapes Charles Hymans Modular analysis of a circuit description language by Abstract Interpretation.
Program Analysis and Verification Spring 2015 Program Analysis and Verification Lecture 12: Abstract Interpretation IV Roman Manevich Ben-Gurion University.
Chapter 2 Logic 2.1 Statements 2.2 The Negation of a Statement 2.3 The Disjunction and Conjunction of Statements 2.4 The Implication 2.5 More on Implications.
1 Shape Analysis via 3-Valued Logic Mooly Sagiv Tel Aviv University Shape analysis with applications Chapter 4.6
Formalization of DFA using lattices. Recall worklist algorithm let m: map from edge to computed value at edge let worklist: work list of nodes for each.
RE-ENGINEERING AND DOMAIN ANALYSIS BY- NISHANTH TIRUVAIPATI.
Program Analysis and Verification Spring 2015 Program Analysis and Verification Lecture 13: Abstract Interpretation V Roman Manevich Ben-Gurion University.
1 Combining Abstract Interpreters Mooly Sagiv Tel Aviv University
Program Analysis and Verification Spring 2014 Program Analysis and Verification Lecture 12: Abstract Interpretation IV Roman Manevich Ben-Gurion University.
Program Analysis and Verification
Sequence Control Syntax and Semantics Jian Xu March 3, 2004 CS706, CAS McMaster.
1 Iterative Program Analysis Abstract Interpretation Mooly Sagiv Tel Aviv University Textbook:
1 Numeric Abstract Domains Mooly Sagiv Tel Aviv University Adapted from Antoine Mine.
Abstraction and Abstract Interpretation. Abstraction (a simplified view) Abstraction is an effective tool in verification Given a transition system, we.
Program Analysis and Verification Spring 2015 Program Analysis and Verification Lecture 8: Static Analysis II Roman Manevich Ben-Gurion University.
Lub and glb Given a poset (S, · ), and two elements a 2 S and b 2 S, then the: –least upper bound (lub) is an element c such that a · c, b · c, and 8 d.
Program Analysis Last Lesson Mooly Sagiv. Goals u Show the significance of set constraints for CFA of Object Oriented Programs u Sketch advanced techniques.
Spring 2017 Program Analysis and Verification
Spring 2016 Program Analysis and Verification
Textbook: Principles of Program Analysis
Spring 2016 Program Analysis and Verification
Spring 2016 Program Analysis and Verification
2.4 & 2.5 Absolute Value Inequalities and Equations
Jaeho Shin ROPAS Show & Tell
Combining Abstract Interpreters
Symbolic Implementation of the Best Transformer
Iterative Program Analysis Abstract Interpretation
פחת ורווח הון סוגיות מיוחדות תהילה ששון עו"ד (רו"ח) ספטמבר 2015
Abstract Interpretation
((a)) A a and c C ((c))
Basic Concept of Inequalities
Abstract Interpretation
Ordered Pair – (11 - 2) CS-708.
Presentation transcript:

1 Systematic Domain Design Some Remarks

2 Best (Conservative) interpretation abstract representation Set of states concretization Abstract semantics statement s abstract representation abstraction Operational semantics statement s Set of states

3 Galois Connections u For –A complete lattice (L 1,  1 ) = (L 1, ,  1,  1,  1,  1 ) –A complete lattice (L 2,  2 ) = (, ,  2,  2,  2,  2 ) –  :L 1  L 2 –  : L 2  L 1 u We say that (L 1, , , L 2 ) is a Galois connection –  and  are monotone –For all c  L 1 :  (  (c))  c –For all a  L 2 :  (  (a))  a

4 Best (Induced) Abstract Transformer u For –A Galois connection (L 1, , , L 2 ) –A function f 1 : L 1  L 1 u Define f 2 = f 1  ( ,  ): L 2  L 2 –f 2 (l 2 ) =  (f 1 (  (l 2 ) ) u Theorem: –f 2 is monotone if f 1 is –f 2 is a sound approximation of f 1 »  l 1  L 1  (f 1 (l 1 ))  f 2 (  (l 1 )) »  l 2  L 2 f 1 (  ( l 2 ))   (f 2 (l 2 )) »For every sound approximation f’ 2 is a sound approximation of f 1 u f 2  f’ 2 u Sometimes we can actually implement the best transformer

5 Best (Induced) Abstract Transformer u But… u It may be difficult to implement u It may be very imprecise –  (f 1 (l 1 ))  f 2 (  (l 1 )) u Indicates inappropriate abstract domain u Sometimes it is better to pick a more expressive domain and work with suboptimal solutions