Graphic example: set of states transitions

x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 38 — ľ P. Cousot

 Example: Reachable states of a transition
system


VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 39 — ľ P. Cousot

 Reachable states in fixpoint form

0 t 0
F (X) = I [ fs j 9s 2 X : s ! s g
„
R = lfp; F

+1
[
= F n(;) where f 0(x) = x
n=0 f n+1(x) = f(f n(x))

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 40 — ľ P. Cousot

 Example of fixpoint iteration
for reachable states lfp; –X . I [ fs0 j 9s 2 X : s !t s0g
„

@ A B 0
F ! " F ! " F ! " F ! "# $ %
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 41 — ľ P. Cousot
 Example of fixpoint iteration
for reachable states lfp; –X . I [ fs0 j 9s 2 X : s !t s0g
„

@ A B 0
F ! " F ! " F ! " F ! "# $ %
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 41 — ľ P. Cousot
 Example of fixpoint iteration
for reachable states lfp; –X . I [ fs0 j 9s 2 X : s !t s0g
„

@ A B 0
F ! " F ! " F ! " F ! "# $ %
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 41 — ľ P. Cousot
 Example of fixpoint iteration
for reachable states lfp; –X . I [ fs0 j 9s 2 X : s !t s0g
„

@ A B 0
F ! " F ! " F ! " F ! "# $ %
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 41 — ľ P. Cousot
 Example of fixpoint iteration
for reachable states lfp; –X . I [ fs0 j 9s 2 X : s !t s0g
„

@ A B 0
F ! " F ! " F ! " F ! "# $ %
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 41 — ľ P. Cousot
 Abstraction by Galois connections

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 42 — ľ P. Cousot

 Abstracting sets (i.e. properties)

– Choose an abstract domain, replacing sets of objects

(states, traces, . . . ) S by their abstraction ¸(S)
– The abstraction function ¸ maps a set of concrete ob-
jects to its abstract interpretation;
– The inverse concretization function ‚ maps an abstract
set of objects to concrete ones;
– Forget no concrete objects: (abstraction from above)
S „ ‚(¸(S)).

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 43 — ľ P. Cousot

 Interval abstraction ¸
"
$$

fx : [1; 99]; y : [2; 77]g

" !! !

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 44 — ľ P. Cousot

 Interval concretization ‚

"
$$

fx : [1; 99]; y : [2; 77]g

" !! !

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 45 — ľ P. Cousot

 The abstraction ¸ is monotone
"
!)
(" fx : [33; 89]; y : [48; 61]g
v
%& fx : [1; 99]; y : [2; 90]g
#
!
" '' &! !!
X „ Y ) ¸(X) v ¸(Y )

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 46 — ľ P. Cousot

 The concretization ‚ is monotone

fx : [33; 89]; y : [48; 61]g

v
fx : [1; 99]; y : [2; 90]g

X v Y ) ‚(X) „ ‚(Y )

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 47 — ľ P. Cousot

 The ‚ ‹ ¸ composition is extensive

"
$$

fx : [1; 99]; y : [2; 77]g

" !! !

X „ ‚ ‹ ¸(X)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 48 — ľ P. Cousot

 The ¸ ‹ ‚ composition is reductive

"
$$
fx : [1; 99]; y : [2; 77]g
==v
fx : [1; 99]; y : [2; 77]g
#

" !! !

¸ ‹ ‚(Y ) ==v Y

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 49 — ľ P. Cousot

 Correspondance between concrete and
abstract properties

– The pair h¸; ‚i is a Galois connection:

‚
``
h}(S); „i `` `
!` hD; vi
¸
‚
– h}(S); „i ````!
`
`!`` hD; vi when ¸ is onto (equivalently
¸
¸ ‹ ‚ = 1 or ‚ is one-to-one).

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 50 — ľ P. Cousot

 Galois connection

‚
``
hD; „i ```` hD; vi
! ¸

iff 8x; y 2 D : x „ y =) ¸(x) v ¸(y)

^ 8x; y 2 D : x v y =) ‚(x) „ ‚(y)
^ 8x 2 D : x „ ‚(¸(x))
^ 8y 2 D : ¸(‚(y)) v x

iff 8x 2 D; y 2 D : ¸(x) v y () x „ ‚(y)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 51 — ľ P. Cousot
 Graphic example: Interval abstraction

x(t)

;0)'*>+&(4$)8(#=9*$"9#(#)+)'#
t

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 52 — ľ P. Cousot

 Graphic example: Abstract transitions

x(t)

;0)'*>+&()*+0#$)$"0
t

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 53 — ľ P. Cousot

 Example: Interval transition semantics of
assignments

int x;
...
l:
x := x + 1;
l’:

fl : x 2 [‘; h] ! l0 : x 2 [l + 1; min(h + 1; max_int)] [

f˙ j h = max_intg j ‘ » hg

where [‘; h] = ; when h < ‘.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 54 — ľ P. Cousot
 *+,-./0- 123/45 Function abstraction
$
#

F] = ¸ ‹ F ‹ ‚
i:e: F ] =  ‹ F
#

6250.7-7 123/45
‚
``
hP; „i `` `
!` hQ; vi )
¸
mon mon –F ] . ‚ ‹F ]‹¸
hP ` _ ```````` `
` _
7 ! P; „i ``````````! hQ 7`! Q; vi
–F . ¸‹F ‹‚
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 55 — ľ P. Cousot
Example: Set of traces to trace of intervals
abstraction
Set of traces:

¸1 #

Trace of sets:

¸2 #

Trace of intervals

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 56 — ľ P. Cousot

Example: Set of traces to reachable states
abstraction
Set of traces:

¸1 #

Trace of sets:

¸3 #

Reachable states

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 57 — ľ P. Cousot

 Composition of Galois Connections
The composition of Galois connections:
‚1
``
hL; »i ```!` hM; vi
¸1
and:
‚2
``
hM; vi ```!` hN; —i
¸2
is a Galois connection:
‚1‹‚2
``
hL; »i ````````
`!` hN; —i
¸2 ‹¸1

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 58 — ľ P. Cousot

 Abstract semantics in fixpoint form

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 59 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of sets of states
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 60 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Graphic example: traces of intervals
in fixpoint form
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 61 — ľ P. Cousot

 Approximate fixpoint abstraction
Abstract domain ] ]
] F
]
]
F F
]
F F
?

â Approximation
relation v

F
F F
? F F
F F Concrete domain
F ] = ¸ ‹ F ‹ ‚ ) ¸(lfp F ) v lfp F ]
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 62 — ľ P. Cousot
 approximate/exact fixpoint abstraction

Exact Abstraction:
¸(lfp F ) = lfp F ]

Approximate Abstraction:
¸(lfp F ) @ lfp F
] ]

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 63 — ľ P. Cousot

 Convergence acceleration
by widening/narrowing

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 64 — ľ P. Cousot

 Graphic example: upward iteration
with widening
x(t)

;0$)$+&(#)+)'#
t

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 65 — ľ P. Cousot

 Graphic example: upward iteration
with widening
x(t)

;0)'*>+&()*+0#$)$"0
t

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 65 — ľ P. Cousot

 Graphic example: upward iteration
with widening
x(t)

;0)'*>+&()*+0#$)$"0(4$)8(4$/'0$0C
t

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 65 — ľ P. Cousot

 Graphic example: upward iteration
with widening
x(t)

;0)'*>+&()*+0#$)$"0(4$)8(4$/'0$0C
t

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 65 — ľ P. Cousot

 Graphic example: stability of the
upward iteration
x(t)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 66 — ľ P. Cousot

 Convergence acceleration with widening

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 67 — ľ P. Cousot

 Widening operator
!
A widening operator 2 L ˆ L 7! L is such that:
– Correctness:
!
- 8x; y 2 L : ‚(x) v ‚(x ! y)
- 8x; y 2 L : ‚(y) v ‚(x y)
– Convergence:
- for all increasing chains x0 v x1 v . . . , the in-
creasing chain defined by y 0 = x0, . . . , y i+1 =
!
y i xi+1, . . . is not strictly increasing.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 68 — ľ P. Cousot

Fixpoint approximation with widening
The upward iteration sequence with widening:
^0 = ?
– X - (infimum)
^ i+1 = X
– X ^i ^ i) v X
if F (X ^i
!
=X^ i F (X
^ i) otherwise
is ultimately stationary and its limit A^ is a sound upper
-
?
approximation of lfp F:
-
?
lfp F v A^

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 69 — ľ P. Cousot

 Interval widening
– L = f?g[f[‘; u] j ‘; u 2 Z[f`1g^u 2 Z[fg^‘ » ug
– The widening extrapolates
! unstable bounds to infinity:
? !X = X
!
X ?=X
[‘0; u0] [‘1; u1] = [if ‘1 < ‘0 then ` 1 else ‘0;
if u1 > u0 then + 1 else u0]
!
Not monotone. For example [0; 1]!v [0; 2] but [0; 1]
[0; 2] = [0; +1] 6v [0; 2] = [0; 2] [0; 2]

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 70 — ľ P. Cousot

 Example: Interval analysis (1975)
Program to be analyzed:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X1 = [1; 1]
>
<
3: X2 = (X1 [ X3) \ [`1; 9999]
od; >
> X3 = X2 ˘ [1; 1]
>
:X
4: 4 = (X1 [ X3) \ [10000; +1]
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 71 — ľ P. Cousot
 Example: Interval analysis (1975)
Equations (abstract interpretation of the semantics):
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = (X1 [ X3) \ [`1; 9999]
od; >
> X3 = X2 ˘ [1; 1]
>
:X = (X [ X ) \ [10000; +1]
4: 4 1 3

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 72 — ľ P. Cousot

 Example: Interval analysis (1975)
Resolution by chaotic increasing iteration:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = ;
>
<
3: X2 = ;
od; >
> X3 = ;
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 73 — ľ P. Cousot

 Example: Interval analysis (1975)
Increasing chaotic iteration:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = ;
od; >
> X3 = ;
>
:X
4: 4 = ;
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot
 Example: Interval analysis (1975)
Increasing chaotic iteration:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 1]
od; >
> X3 = ;
>
:X
4: 4 = ;
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot
 Example: Interval analysis (1975)
Increasing chaotic iteration:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 1]
od; >
> X3 = [2; 2]
>
:X
4: 4 = ;
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot
 Example: Interval analysis (1975)
Increasing chaotic iteration:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 2]
od; >
> X3 = [2; 2]
>
:X
4: 4 = ;
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot
 Example: Interval analysis (1975)
Increasing chaotic iteration: convergence !
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 2]
od; >
> X3 = [2; 3]
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot

 Example: Interval analysis (1975)
Increasing chaotic iteration: convergence !!
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 3]
od; >
> X3 = [2; 3]
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot

 Example: Interval analysis (1975)
Increasing chaotic iteration: convergence !!!
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 3]
od; >
> X3 = [2; 4]
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot

 Example: Interval analysis (1975)
Increasing chaotic iteration: convergence !!!!
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 4]
od; >
> X3 = [2; 4]
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot

 Example: Interval analysis (1975)
Increasing chaotic iteration: convergence !!!!!
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 4]
od; >
> X3 = [2; 5]
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot

 Example: Interval analysis (1975)
Increasing chaotic iteration: convergence !!!!!!
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 5]
od; >
> X3 = [2; 5]
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot

 Example: Interval analysis (1975)
Increasing chaotic iteration: convergence !!!!!!!
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 5]
od; >
> X3 = [2; 6]
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 74 — ľ P. Cousot

 Example: Interval analysis (1975)
Convergence speed-up by widening:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; +1] ( widening
od; >
> X3 = [2; 6]
>
:X = ;
4: 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 75 — ľ P. Cousot

 Example: Interval analysis (1975)
Decreasing chaotic iteration:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; +1]
od; >
> X3 = [2; +1]
>
:X
4: 4 = ;
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 76 — ľ P. Cousot
 Example: Interval analysis (1975)
Decreasing chaotic iteration:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 9999]
od; >
> X3 = [2; +1]
>
:X
4: 4 = ;
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 76 — ľ P. Cousot
 Example: Interval analysis (1975)
Decreasing chaotic iteration:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: X2 = [1; 9999]
od; >
> X3 = [2; +10000]
>
:X
4: 4 = ;
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 76 — ľ P. Cousot
 Example: Interval analysis (1975)
Final solution:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: >
:X
4 = (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: 8
x := x + 1 >
> X1 = [1; 1]
>
<
3: X2 = [1; 9999]
od; >
> X3 = [2; +10000]
>
:X
4: 4 = [+10000; +10000]
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 77 — ľ P. Cousot
 Example: Interval analysis (1975)
Result of the interval analysis:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: {x = 1} >
:X =
4 (X1 [ X3) \ [10000; +1]
while x < 10000 do
2: {x 2 [1; 9999]} 8
x := x + 1 >
> X 1 = [1; 1]
>
<
3: {x 2 [2; +10000]} X2 = [1; 9999]
od; >
> X3 = [2; +10000]
>
:X =
4: {x = 10000} 4 [+10000; +10000]
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 78 — ľ P. Cousot
 Example: Interval analysis (1975)
Checking absence of runtime errors with interval analysis:
8
>
> X1 = [1; 1]
>
<
X2 = (X1 [ X3) \ [`1; 9999]
x := 1;
>
> X3 = X2 ˘ [1; 1]
1: {x = 1} >
:X = (X [ X ) \ [10000; +1]
4 1 3
while x < 10000 do
2: {x 2 [1; 9999]} 8
x := x + 1 >
> ` no overflow
>
<
3: {x 2 [2; +10000]} X2 = [1; 9999]
od; >
> X3 = [2; +10000]
>
:X = [+10000; +10000]
4: {x = 10000} 4

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 79 — ľ P. Cousot

 Refinement of abstractions

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 80 — ľ P. Cousot

Approximations of an [in]finite set of points:
from above

f: : : ; h19; 77i; : : : ;
h20; 03i; : : :g

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 81 — ľ P. Cousot

Approximations of an [in]finite set of points:
from above
?
?

?
?
y
f: : : ; h19; 77i; : : : ;
? ?
?
? ?

?
h20; 03i; h?; ?i; : : :g

From Below: dual 2 + combinations.

2 Trivial for finite states (liveness model-checking), more difficult for infinite states (variant functions).

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 82 — ľ P. Cousot

Effective computable approximations of an
[in]finite set of points; Signs 3

y

x–0
y–0

3 P. Cousot & R. Cousot. Systematic design of program analysis frameworks. ACM POPL’79, pp. 269–282,
1979.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 83 — ľ P. Cousot

Effective computable approximations of an
[in]finite set of points; Intervals 4

y

x 2 [19; 77]
y 2 [20; 03]

4 P. Cousot & R. Cousot. Static determination of dynamic properties of programs. Proc. 2nd Int. Symp. on
Programming, Dunod, 1976.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 84 — ľ P. Cousot

Effective computable approximations of an
[in]finite set of points; Octagons 5

8
>
> 1»x»9
>
<
y x + y » 77
>
> 1»y»9
>
: x ` y » 99

5 A. Miné. A New Numerical Abstract Domain Based on Difference-Bound Matrices. PADO ’2001.
LNCS 2053, pp. 155–172. Springer 2001. See the The Octagon Abstract Domain Library on
http://www.di.ens.fr/~mine/oct/

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 85 — ľ P. Cousot

Effective computable approximations of an
[in]finite set of points; Polyhedra 6

y

19x + 77y » 2004
20x + 03y – 0

6 P. Cousot & N. Halbwachs. Automatic discovery of linear restraints among variables of a program. ACM
POPL, 1978, pp. 84–97.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 86 — ľ P. Cousot

Effective computable approximations of an
[in]finite set of points; Simple
congruences 7

y

x = 19 mod 77
y = 20 mod 99

7 Ph. Granger. Static Analysis of Arithmetical Congruences. Int. J. Comput. Math. 30, 1989, pp. 165–190.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 87 — ľ P. Cousot

Effective computable approximations of an
[in]finite set of points; Linear
congruences 8

y

1x + 9y = 7 mod 8
2x ` 1y = 9 mod 9

8 Ph. Granger. Static Analysis of Linear Congruence Equalities among Variables of a Program.
TAPSOFT ’91, pp. 169–192. LNCS 493, Springer, 1991.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 88 — ľ P. Cousot

Effective computable approximations of an
[in]finite set of points; Trapezoidal lin-
ear congruences 9


1x + 9y 2 [0; 77] mod 10
2x ` 1y 2 [0; 99] mod 11

9 F. Masdupuy. Array Operations Abstraction Using Semantic Analysis of Trapezoid Congruences. ACM
ICS ’92.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 89 — ľ P. Cousot

 Refinement of iterates

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 90 — ľ P. Cousot

 Graphic example: Refinement required
by false alarms
x(t)
."*%$//'0(1"0'

.+&#'(+&+*<#

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 91 — ľ P. Cousot

 Graphic example: Partitionning

x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 92 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: partitionned upward itera-
tion with widening
x(t)

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 93 — ľ P. Cousot
 Graphic example: safety verification

x(t)
."*%$//'0(1"0'

!"##$%&'(
/$#-*')'(
)*+,'-)"*$'#

t
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 94 — ľ P. Cousot
 Examples of partitionnings

– sets of control states: attach local information to pro-

gram points instead of global information for the whole
program/procedure/loop
– sets of data states:
- case analysis (test, switches)
– fixpoint iterates:
- widening with threshold set

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 95 — ľ P. Cousot

 Interval widening with threshold set
– The threshold set T is a finite set of numbers (plus
+1 and `1),
!
– [a; b] T [a0; b0] = [if a0 < a then maxf‘ 2 T j ‘ » a0g
else a;
if b0 > b then minfh 2 T j h – b0g
else b] :
– Examples (intervals):
- sign analysis: T = f`1; 0; +1g;
- strict sign analysis: T = f`1; `1; 0; +1; +1g;
– T is a parameter of the analysis.
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 96 — ľ P. Cousot
 Combinations of abstractions

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 97 — ľ P. Cousot

 Forward/reachability analysis

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 98 — ľ P. Cousot

 Backward/ancestry analysis

F
I

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 99 — ľ P. Cousot

 Iterated forward/backward analysis

F
I

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 100 — ľ P. Cousot
Example of iterated forward/backward analysis
Arithmetical mean of two integers x and y:
{x>=y}
while (x <> y) do
{x>=y+2}
x := x - 1;
{x>=y+1}
y := y + 1
{x>=y}
od
{x=y}
Necessarily x – y for proper termination

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 101 — ľ P. Cousot
Example of iterated forward/backward analysis
Adding an auxiliary counter k decremented in the loop
body and asserted to be null on loop exit:
{x=y+2k,x>=y}
while (x <> y) do
{x=y+2k,x>=y+2}
k := k - 1;
{x=y+2k+2,x>=y+2}
x := x - 1;
{x=y+2k+1,x>=y+1}
y := y + 1 Moreover the differ-
{x=y+2k,x>=y}
od ence of x and y must
{x=y,k=0} be even for proper ter-
assume (k = 0)
{x=y,k=0} mination

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 102 — ľ P. Cousot
 Bibliography

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 103 — ľ P. Cousot
 Seminal papers
– Patrick Cousot & Radhia Cousot. Abstract interpretation: a
unified lattice model for static analysis of programs by con-
struction or approximation of fixpoints. In 4th Symp. on Prin-
ciples of Programming Languages, pages 238—252. ACM Press,
1977.
– Patrick Cousot & Nicolas Halbwachs. Automatic discovery of
linear restraints among variables of a program. In 5th Symp.
on Principles of Programming Languages, pages 84—97. ACM
Press, 1978.
– Patrick Cousot & Radhia Cousot. Systematic design of pro-
gram analysis frameworks. In 6th Symp. on Principles of Pro-
gramming Languages pages 269—282. ACM Press, 1979.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 104 — ľ P. Cousot
 Recent surveys
– Patrick Cousot. Interprétation abstraite. Technique et Science
Informatique, Vol. 19, Nb 1-2-3. Janvier 2000, Hermès, Paris,
France. pp. 155-164.
– Patrick Cousot. Abstract Interpretation Based Formal Meth-
ods and Future Challenges. In Informatics, 10 Years Back —
10 Years Ahead, R. Wilhelm (Ed.), LNCS 2000, pp. 138-156,
2001.
– Patrick Cousot & Radhia Cousot. Abstract Interpretation
Based Verification of Embedded Software: Problems and Per-
spectives. In Proc. 1st Int. Workshop on Embedded Software,
EMSOFT 2001, T.A. Henzinger & C.M. Kirsch (Eds.), LNCS
2211, pp. 97–113. Springer, 2001.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 105 — ľ P. Cousot
 Conclusion

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 106 — ľ P. Cousot
Theoretical applications of abstract interpretation
– Static Program Analysis [POPL ’77,78,79] inluding Data-
flow Analysis [POPL ’79,00], Set-based Analysis [FPCA ’95],
etc
– Syntax Analysis [TCS 290(1) 2002]
– Hierarchies of Semantics (including Proofs) [POPL ’92, TCS
277(1–2) 2002]
– Typing [POPL ’97]
– Model Checking [POPL ’00]
– Program Transformation [POPL ’02]
– Software watermarking [POPL ’04]
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 107 — ľ P. Cousot
 Practical applications of abstract
interpretation
– Program analysis and manipulation: a small rate of false
alarms is acceptable
- AiT: worst case execution time – Christian Ferdi-
nand
– Program verification: no false alarms is acceptable
- TVLA: A system for generating abstract interpreters
– Mooly Sagiv
- Astrée: verification of absence of run-time errors –
Laurent Mauborgne
VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 108 — ľ P. Cousot
 Industrial applications of abstract
interpretation
– Both to Program analysis and verification
– Experience with the industrial use of abstract interpre-
tation-based static analysis tools – Jean Souyris (Air-
bus France)

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 109 — ľ P. Cousot
 THE END

More references at URL www.di.ens.fr/~cousot.

VMCAI’05 Industrial Day, Paris, France, January 20, 2005 — 110 — ľ P. Cousot