Abstract Domains of Affine Relations

• Published in: ACM transactions on programming languages and systems Vol. 36; no. 4; pp. 1 - 73
• Main Authors: Elder, Matt, Lim, Junghee, Sharma, Tushar, Andersen, Tycho, Reps, Thomas
• Format: Journal Article
• Language: English
• Published: New York, NY, USA ACM 28.10.2014
• Subjects: Algorithms; Analyzers; Assertion checking; Assertions; Blasting; Blocking; Cross-computing tools and techniques; Empirical software validation; Formal methods; Formal software verification; Functional verification; General and reference; Hardware; Hardware validation; Invariants; Mathematical analysis; Process validation; Program reasoning; Program verification; Rings (mathematics); Semantics; Semantics and reasoning; Software and its engineering; Software creation and management; Software functional properties; Software organization and properties; Software verification and validation; Theory of computation; Transformers; Validation; Howell form; symbolic abstraction; modular arithmetic; abstract interpretation; static analysis; affine relation; Abstract domain
• ISSN: 0164-0925; 1558-4593
• DOI: 10.1145/2651361

This article considers some known abstract domains for affine-relation analysis (ARA), along with several variants, and studies how they relate to each other. The various domains represent sets of points that satisfy affine relations over variables that hold machine integers and are based on an extension of linear algebra to modules over a ring (in particular, arithmetic performed modulo 2w, for some machine-integer width w). We show that the abstract domains of Müller-Olm/Seidl (MOS) and King/Søndergaard (KS) are, in general, incomparable. However, we give sound interconversion methods. In other words, we give an algorithm to convert a KS element vKS to an overapproximating MOS element vMOS-that is, γ (vKS) ⊆ γ (vMOS-as well as an algorithm to convert an MOS element wMOS to an overapproximating KS element wKS-that is, γ (wMOS) ⊆ γ (wKS). The article provides insight on the range of options that one has for performing ARA in a program analyzer: -We describe how to perform a greedy, operator-by-operator abstraction method to obtain KS abstract transformers. -We also describe a more global approach to obtaining KS abstract transformers that considers the semantics of an entire instruction, basic block, or other loop-free program fragment. The latter method can yield best abstract transformers, and hence can be more precise than the former method. However, the latter method is more expensive. We also explain how to use the KS domain for interprocedural program analysis using a bit-precise concrete semantics, but without bit blasting.