Skip to main content
SpringerLink
Log in

An Abstract Domain of Uninterpreted Functions

  • Conference paper
  • First Online:
Verification, Model Checking, and Abstract Interpretation (VMCAI 2016)

Part of the book series: Lecture Notes in Computer Science ((LNTCS,volume 9583))

Abstract

We revisit relational static analysis of numeric variables. Such analyses face two difficulties. First, even inexpensive relational domains scale too poorly to be practical for large code-bases. Second, to remain tractable they have extremely coarse handling of non-linear relations. In this paper, we introduce the subterm domain, a weakly relational abstract domain for inferring equivalences amongst sub-expressions, based on the theory of uninterpreted functions. This provides an extremely cheap approach for enriching non-relational domains with relational information, and enhances precision of both relational and non-relational domains in the presence of non-linear operations. We evaluate the idea in the context of the software verification tool SeaHorn.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    We show transitive reductions and omit trivial bounds for variables. The result obtained by the subterm domain for C, includes, behind the scenes, a term equation \(t = u + s\) and a bound \(0 \le s \le 10\) on the freshly introduced variable s.

  2. 2.

    \(\sqsubseteq \) is extended to the term lattice by defining \(\bot \sqsubseteq t\) for all elements \(t \in \mathcal{T}_{/\equiv }\).

  3. 3.

    This behaviour is also a well recognized problem for finite domain constraint solvers (see e.g. [11]).

  4. 4.

    A program with its corresponding safety property also provided by the competition.

  5. 5.

    We used the command (i.e., large-block encoding [2] of the transition system modelling both pointer offsets and memory contents). For DD64 we add the option .

  6. 6.

    We used an implementation of the classical DBM domain following [19] for the experiment in Table 2 but it took more than three hours to complete.

References

  1. Beyer, D.: Software verification and verifiable witnesses. In: Baier, C., Tinelli, C. (eds.) TACAS 2015. LNCS, vol. 9035, pp. 401–416. Springer, Heidelberg (2015)

    Google Scholar 

  2. Beyer, D., Cimatti, A., Griggio, A., Keremoglu, M.E., Sebastiani, R.: Software model checking via large-block encoding. In: Biere, A., Pixley, C., (eds.) Proceedings of the Ninth International Conference on Formal Methods in Computer-Aided Design, pp. 25–32. IEEE Computer Society (2009)

    Google Scholar 

  3. Bordeaux, L., Katsirelos, G., Narodytska, N., Vardi, M.Y.: The complexity of integer bound propagation. J. Artif. Intell. Res. (JAIR) 40, 657–676 (2011)

    MATH  MathSciNet  Google Scholar 

  4. Bouaziz, M.: TreeKs: a functor to make numerical abstract domains scalable. Electron. Notes Theor. Comput. Sci. 287, 41–52 (2012)

    Article  Google Scholar 

  5. Chang, B.-Y.E., M. Leino, K.R.: Abstract interpretation with alien expressions and heap structures. In: Cousot, R. (ed.) VMCAI 2005. LNCS, vol. 3385, pp. 147–163. Springer, Heidelberg (2005)

    Chapter  Google Scholar 

  6. Cousot, P., Cousot, R.: Static determination of dynamic properties of programs. In: Proceedings of the Second International Symposium on Programming, pp. 106–130. Dunod (1976)

    Google Scholar 

  7. Cousot, P., Cousot, R.: Abstract interpretation frameworks. J. Logic Comput. 2(4), 511–547 (1992)

    Article  MATH  MathSciNet  Google Scholar 

  8. Cousot, P., Cousot, R., Feret, J., Mauborgne, L., Miné, A., Rival, X.: Why does Astrée scale up? Formal Meth. Syst. Des. 35(3), 229–264 (2009)

    Article  MATH  Google Scholar 

  9. Cousot, P., Halbwachs, N.: Automatic discovery of linear constraints among variables of a program. In: Proceedings of the Fifth ACM Symposium on Principles of Programming Languages, pp. 84–97. ACM Press (1978)

    Google Scholar 

  10. Downey, P.J., Sethi, R., Tarjan, R.E.: Variations on the common subexpression problem. J. ACM 27(4), 758–771 (1980)

    Article  MATH  MathSciNet  Google Scholar 

  11. Feydy, T., Schutt, A., Stuckey, P.: Global difference constraint propagation for finite domain solvers. In: Antoy, S. (ed.) Proceedings of 10th International ACM SIGPLAN Symposium on Principles and Practice of Declarative Programming, pp. 226–235. ACM Press (2008)

    Google Scholar 

  12. Gange, G., Navas, J.A., Schachte, P., Søndergaard, H., Stuckey, P.J.: Abstract interpretation over non-lattice abstract domains. In: Logozzo, F., Fähndrich, M. (eds.) Static Analysis. LNCS, vol. 7935, pp. 6–24. Springer, Heidelberg (2013)

    Chapter  Google Scholar 

  13. Gurfinkel, A., Kahsai, T., Komuravelli, A., Navas, J.A.: The seahorn verification framework. In: Kroening, D., Păsăreanu, C.S. (eds.) CAV 2015. LNCS, vol. 9206, pp. 343–361. Springer, Heidelberg (2015)

    Chapter  Google Scholar 

  14. Howe, J.M., King, A.: Logahedra: a new weakly relational domain. In: Liu, Z., Ravn, A.P. (eds.) ATVA 2009. LNCS, vol. 5799, pp. 306–320. Springer, Heidelberg (2009)

    Chapter  Google Scholar 

  15. Huet, G.: Résolution d’Équations dans des Langages d’Ordre 1, 2, ..., \(\omega \). Thèse d’État. Université Paris VII (1976)

    Google Scholar 

  16. Komuravelli, A., Gurfinkel, A., Chaki, S., Clarke, E.M.: Automatic abstraction in SMT-based unbounded software model checking. In: Sharygina, N., Veith, H. (eds.) CAV 2013. LNCS, vol. 8044, pp. 846–862. Springer, Heidelberg (2013)

    Chapter  Google Scholar 

  17. Lattner, C., Adve, V.: LLVM: a compilation framework for lifelong program analysis and transformation. In: Proceedings of the International Symposium on Code Generation and Optimization, pp. 75–86. IEEE Computer Society (2004)

    Google Scholar 

  18. Logozzo, F., Fähndrich, M.: Pentagons: a weakly relational abstract domain for the efficient validation of array accesses. In: Proceedings of the 2008 ACM Symposium on Applied Computing, pp. 184–188. ACM Press (2008)

    Google Scholar 

  19. Miné, A.: A new numerical abstract domain based on difference-bound matrices. In: Danvy, O., Filinski, A. (eds.) PADO 2001. LNCS, vol. 2053, pp. 155–172. Springer, Heidelberg (2001)

    Chapter  Google Scholar 

  20. Miné, A.: The octagon abstract domain. High. Ord. Symbolic Comput. 19(1), 31–100 (2006)

    Article  MATH  Google Scholar 

  21. Miné, A.: Symbolic methods to enhance the precision of numerical abstract domains. In: Emerson, E.A., Namjoshi, K.S. (eds.) VMCAI 2006. LNCS, vol. 3855, pp. 348–363. Springer, Heidelberg (2006)

    Chapter  Google Scholar 

  22. Simon, A., King, A.: The two variable per inequality abstract domain. High. Ord. Symbolic Comput. 23(1), 87–143 (2010)

    Article  MATH  MathSciNet  Google Scholar 

  23. Simon, A., King, A., Howe, J.M.: Two variables per linear inequality as an abstract domain. In: Leuschel, M. (ed.) LOPSTR 2002. LNCS, vol. 2664, pp. 71–89. Springer, Heidelberg (2003)

    Chapter  Google Scholar 

  24. Venet, A., Brat, G.: Precise and efficient static array bound checking for large embedded C programs. In: Proceedings of the ACM SIGPLAN 2004 Conference on Programming Language Design and Implementation, pp. 231–242. ACM Press (2004)

    Google Scholar 

  25. Venet, A.J.: The gauge domain: scalable analysis of linear inequality invariants. In: Madhusudan, P., Seshia, S.A. (eds.) CAV 2012. LNCS, vol. 7358, pp. 139–154. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

Download references

Acknowledgments

This work has been supported by the Australian Research Council through grant DP140102194. We would like to thank Maxime Arthaud for implementating the abstract domain of difference-bound matrices with variable packing.

Author information

Authors and Affiliations

  1. Department of Computing and Information Systems, The University of Melbourne, Melbourne, VIC, 3010, Australia

    Graeme Gange, Peter Schachte, Harald Søndergaard & Peter J. Stuckey

  2. NASA Ames Research Center, Moffett Field, CA, 94035, USA

    Jorge A. Navas

Authors
  1. Graeme Gange
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jorge A. Navas
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Peter Schachte
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Harald Søndergaard
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Peter J. Stuckey
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Graeme Gange .

Editor information

Editors and Affiliations

  1. EPFL IC-DO, Lausanne, Switzerland

    Barbara Jobstmann

  2. Microsoft Research, Redmond, Washington, USA

    K. Rustan M. Leino

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Gange, G., Navas, J.A., Schachte, P., Søndergaard, H., Stuckey, P.J. (2016). An Abstract Domain of Uninterpreted Functions. In: Jobstmann, B., Leino, K. (eds) Verification, Model Checking, and Abstract Interpretation. VMCAI 2016. Lecture Notes in Computer Science(), vol 9583. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-49122-5_4

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-49122-5_4

  • Published:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-49121-8

  • Online ISBN: 978-3-662-49122-5

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation