## Trace partitioning in abstract interpretation based static analyzers (2005)

### Cached

### Download Links

- [www.di.ens.fr]
- [www.di.ens.fr]
- [www.di.ens.fr]
- [www.di.ens.fr]
- DBLP

### Other Repositories/Bibliography

Venue: | In ESOP |

Citations: | 60 - 10 self |

### BibTeX

@INPROCEEDINGS{Mauborgne05tracepartitioning,

author = {Laurent Mauborgne and Xavier Rival},

title = {Trace partitioning in abstract interpretation based static analyzers},

booktitle = {In ESOP},

year = {2005},

pages = {5--20},

publisher = {Springer}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. When designing a tractable static analysis, one usually needs to approximate the trace semantics. This paper proposes a systematic way of regaining some knowledge about the traces by performing the abstraction over a partition of the set of traces instead of the set itself. This systematic refinement is not only theoretical but tractable: we give automatic procedures to build pertinent partitions of the traces and show the efficiency on an implementation integrated in the Astrée static analyzer, a tool capable of dealing with industrial-size software. 1

### Citations

631 | Systematic Design of Program Analysis Frameworks
- Cousot, Cousot
- 1979
(Show Context)
Citation Context ...ast upper bound) of the intervals [−1, −1] and [1, 1] is the interval [−1, 1] and 0 ∈ [−1, 1]. A simple fix would be to use a more expressive abstract domain. For instance, the disjunctive completion =-=[8]-=- of the interval domain would allow the property to be proved: an abstract value would be a finite union of intervals; hence, the analysis would report x to be in [−1, −1] ∪ [1, 1] at the end of the a... |

572 | Automatic discovery of linear restraints among variables of a program
- Cousot, Halbwachs
- 1978
(Show Context)
Citation Context ...sidered as an alternative to disjunctive completion; yet, they may also be costly in practice and their design may be involved. For instance, commonsrelational domains like octagons [15] or polyhedra =-=[10]-=- would not help here, since they describe convex sets of values, so the abstract union operator is an imprecise over-approximation of the concrete union. A reduced product of the domain of intervals w... |

232 | The Octagon Abstract Domain
- Miné
(Show Context)
Citation Context ...mains could be considered as an alternative to disjunctive completion; yet, they may also be costly in practice and their design may be involved. For instance, commonsrelational domains like octagons =-=[15]-=- or polyhedra [10] would not help here, since they describe convex sets of values, so the abstract union operator is an imprecise over-approximation of the concrete union. A reduced product of the dom... |

180 | A static analyzer for large safety-critical software
- Blanchet, Cousot, et al.
- 2003
(Show Context)
Citation Context ...Finding precise invariants when analyzing divisions sharing a variable in the dividend and divider require either complex ad-hoc transfer functions (as in [11]) or guessing an appropriate linear form =-=[3]-=-. If the variable found in the dividend and divider ranges in a small set (less than, say, a thousand) we can get very precise results by partitioning the traces according to the dynamic values of tha... |

91 | Design and implementation of a specialpurpose static program analyzer for safety-critical real-time embedded software
- Cousot
- 2002
(Show Context)
Citation Context ...tegies for partition creation during the analysis. All the results presented in the paper are supported by the experience of the design, implementation and practical use of the Astrée static analyzer =-=[2, 14]-=-. This analyzer aims at certifying the absence of run-time errors (and user-defined non-desirable behaviors) in very large synchronous embedded applications such as avionics software. Trace partitioni... |

90 |
Méthodes itératives de construction et d’approximation de points fixes d’opérateurs monotones sur un treillis, analyse sémantique des programmes. Université Scientifique et Médicale de Grenoble
- Cousot
- 1978
(Show Context)
Citation Context ... partitioning together with some practical examples in Sect. 4. Finally, we conclude in Sect. 5. 2 Theoretical Framework This section supposes basic knowledge of the abstract interpretation framework =-=[5]-=-. For an introduction, the reader is referred to [9].s2.1 Definitions Programs: We define a program P as a transition system (S, →, Sι) where S is the set of states of the program; → is the transition... |

89 |
Semantic foundations of program analysis
- Cousot
- 1981
(Show Context)
Citation Context ...analysis time. Of course, using partitioning each iteration takes longer, but the cost in time and memory is very reasonable. 5 Conclusion The partitioning of abstract domains was first introduced in =-=[6]-=-; it describes trace partitioning on the concrete level (sets of traces). We proposed to use such partitions to guide a restricted kind of disjunctions. Disjunctive completion usually gives very preci... |

85 | Improving data-flow analysis with path profiles
- Ammons, Larus
- 1998
(Show Context)
Citation Context ...lar sgn cannot be equal to 0. As a consequence, dividing by sgn is safe. However, a simple interval analysis [7] would not discover it, since the lub (least upper bound) of the intervals [−1, −1] and =-=[1, 1]-=- is the interval [−1, 1] and 0 ∈ [−1, 1]. A simple fix would be to use a more expressive abstract domain. For instance, the disjunctive completion [8] of the interval domain would allow the property t... |

50 |
Static analysis of digital filters
- Feret
- 2004
(Show Context)
Citation Context ...ter the expression e is used. 4.3 Barycenter Finding precise invariants when analyzing divisions sharing a variable in the dividend and divider require either complex ad-hoc transfer functions (as in =-=[11]-=-) or guessing an appropriate linear form [3]. If the variable found in the dividend and divider ranges in a small set (less than, say, a thousand) we can get very precise results by partitioning the t... |

48 |
Static analysis of arithmetical congruences
- Granger
- 1989
(Show Context)
Citation Context ...nce they describe convex sets of values, so the abstract union operator is an imprecise over-approximation of the concrete union. A reduced product of the domain of intervals with a congruence domain =-=[12]-=- succeeds in proving the property, since −1 and 1 are both in {1 + 2 × k | k ∈ N}. However, a more intuitive way to solve the difficulty would be to relate the value of sgn to the way it is computed. ... |

35 | Abstract Interpretation by dynamic partitioning
- Bourdoncle
- 1992
(Show Context)
Citation Context ...c analysis cost, possibly for no precision improvement. Other applications include the dynamic choice of the number of unrolled iterations in a loop (Sect. 4.4) or the analysis of recursive functions =-=[4]-=-. Widening: Because the basis contains infinite ascending chains, we need a widening to use the trace partitioning domain in practice. We can produce a widening on D ♯ as soon as we have a widening on... |

35 |
Qualified data flow problems
- HOLLEY, ROSEN
- 1981
(Show Context)
Citation Context ...h was first suggested by [16]; yet, it was presented in a rather limited framework and no implementation result was provided. The same idea was already present in the context of data-flow analysis in =-=[13]-=- where the history of computation is traced using an automaton chosen before the analysis. Choosing of the relevant partitioning (which explicit disjunctions to keep during the static analysis) is a r... |

23 |
Abstract intrepretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ... = 1; } Clearly sgn is either equal to 1 or −1 at the end of this piece of code; in particular sgn cannot be equal to 0. As a consequence, dividing by sgn is safe. However, a simple interval analysis =-=[7]-=- would not discover it, since the lub (least upper bound) of the intervals [−1, −1] and [1, 1] is the interval [−1, 1] and 0 ∈ [−1, 1]. A simple fix would be to use a more expressive abstract domain. ... |

18 |
S.: Refining static analyses by trace-based partitioning using control-flow
- Handjieva, Tzolovski
- 1998
(Show Context)
Citation Context ...eria. Each element of the disjunction is related to some property about the history of concrete computations, such as “which branch of the conditional was taken”. This approach was first suggested by =-=[16]-=-; yet, it was presented in a rather limited framework and no implementation result was provided. The same idea was already present in the context of data-flow analysis in [13] where the history of com... |

15 | Abstract Cofibered Domains: Application to the Alias Analysis of Untyped Programs - Venet - 1996 |

13 | Basic concepts of abstract interpretation
- COUSOT, COUSOT
- 2004
(Show Context)
Citation Context ...in Sect. 4. Finally, we conclude in Sect. 5. 2 Theoretical Framework This section supposes basic knowledge of the abstract interpretation framework [5]. For an introduction, the reader is referred to =-=[9]-=-.s2.1 Definitions Programs: We define a program P as a transition system (S, →, Sι) where S is the set of states of the program; → is the transition relation describing the possible execution elementa... |

13 | Astrée: Verification of absence of run-time error
- Mauborgne
- 2004
(Show Context)
Citation Context ...tegies for partition creation during the analysis. All the results presented in the paper are supported by the experience of the design, implementation and practical use of the Astrée static analyzer =-=[2, 14]-=-. This analyzer aims at certifying the absence of run-time errors (and user-defined non-desirable behaviors) in very large synchronous embedded applications such as avionics software. Trace partitioni... |