
In this thesis, we are interested in improving the scalability of Linear Relation Analysis,
or abstract interpretation based on convex polyhedra, by computing precise relational
summaries of procedures. We make use of the procedural structure of programs to propose
a new modular analysis for the automatic discovery of numerical properties. Although
specifically applied to convex polyhedra, it is based on a more general framework usable
with any relational abstract domain.
Our analysis framework comes with a formalization of relational abstract interpreta-
tion that we did not find elsewhere. Based on relational collecting semantics, we present
the construction of relational procedure summaries as abstract input-relations between
the initial values of procedure parameters and their final value at the exit of a procedure.
Procedures can exhibit very different behaviors which can not be expressed precisely
by a single element of a classical abstract domain such as convex polyhedra. In order to
have precise procedure summaries, we compute disjunctive relational summaries, where
each disjunct is an abstract input-output relation represented by a separate element of a
relational abstract domain.
Taken together, the sources of each individual relation in a disjunctive summary form
an abstract partition of the procedure precondition to account for all the possible values
of parameters. The precision of a disjunctive summary is determined by the quality
of the precondition partitioning. We give heuristics to compute an abstract partition
of a procedure precondition. We also give ways to improve the precision of summary
computation. As we show that preconditions are at the heart of precise summaries, they
are entitled to a specific and careful treatment during summary computation. Summaries
are computed once and for all in a bottom-up fashion and used to analyze the effect of
procedure calls.
We also show that our approach applies to recursive procedures. In some way, the
summary of a recursive procedure must be computed in terms of itself.
16
0
第1章引言
0
Astr´ee成功地扩展到了用C语言编写的大型嵌入式程序,但避免了更精确的抽象域,如凸多面
体,因为它们的计算复杂度较高。而是使用了不太表达的抽象域,如整数区间或八边形。尽管
大型程序被组织为函数或过程的集合,Astr´ee对程序进行自上而下的分析,而不真正考虑它们
的过程间结构。过程要么被内联,要么在每次调用时重新分析。
0
1.2贡献
0
在本论文中,我们致力于通过计算精确的过程关系摘要来提高线性关系分析的可扩展性,或者基于凸多面体的抽象解释。我们利用程序的
过程结构,提出了一种新的模块化分析方法,用于自动发现数值属性。尽管专门应用于凸多面体,但它基于一个更通用的框架,可与任何
关系抽象域一起使用。我们的分析框架提供了一个关系抽象解释的形式化,我们在其他地方没有找到。基于关系收集语义,我们介绍了关
系过程摘要的构建,作为过程参数初始值与过程退出时的最终值之间的抽象输入关系。过程可能表现出非常不同的行为,这些行为不能通
过经典抽象域(如凸多面体)的单个元素来精确表示。为了获得精确的过程摘要,我们计算了不交的关系摘要,其中每个不交由关系抽象
域的单独元素表示,代表一个抽象输入输出关系。在一个不交摘要中,每个单独关系的源构成了过程前置条件的抽象划分,以考虑参数的
所有可能值。不交摘要的精确性取决于前置条件划分的质量。我们提供了启发式方法来计算过程前置条件的抽象划分。我们还提供了改进
摘要计算精度的方法。正如我们所展示的,前置条件是精确摘要的核心,它们在摘要计算过程中应受到特殊和谨慎的处理。摘要是一次性
地以自下而上的方式计算出来,并用于分析过程调用的效果。我们还展示了我们的方法适用于递归过程。在某种程度上,递归过程的摘要
必须以自身为基础进行计算。
0
使用关系过程摘要进行模块化分析