Automatic Abstraction for Congruences

Abstract

Abstract. One approach to verifying bit-twiddling algorithms is to derive invariants between the bits that constitute the variables of a program. Such invariants can often be described with systems of congruences where in each equation c · x = d mod m, m is a power of two, c is a vector of integer coefficients, and x is a vector of propositional variables (bits). Because of the low-level nature of these invariants and the large number of bits that are involved, it is important that the transfer functions can be derived automatically. We address this problem, showing how an analysis for bit-level congruence relationships can be decoupled into two parts: (1) a SAT-based abstraction (compilation) step which can be automated, and (2) an interpretation step that requires no SATsolving. We exploit triangular matrix forms to derive transfer functions efficiently, even in the presence of large numbers of bits. Finally we propose program transformations that improve the analysis results.

A Method for Symbolic Computation of Abstract Operations

“…Heretofore, algorithms for performing best abstract operations have been known for only a few abstract domains [15,36,43,38,23,30,14]. Moreover, there is a gap in current technology for performing best abstract operations: an algorithm is known for performing α for affine-relation analysis (ARA) [23,14], and can be used to compute best ARA transformers.…”

“…Moreover, there is a gap in current technology for performing best abstract operations: an algorithm is known for performing α for affine-relation analysis (ARA) [23,14], and can be used to compute best ARA transformers. However, the algorithm makes repeated calls to an SMT (Satisfiability Modulo Theories) solver, and is ∼185x slower [14] than a compositional, syntax-directed method for creating sound, but not necessarily best, ARA transformers.…”

Abstract Domains of Affine Relations

“…Müller-Olm and Seidl introduced the MOS domain for affine relations, and gave an algorithm for interprocedural ARA [19,21]. King and Søndergaard defined the KS domain, and used it to create implementations of best abstract ARA transformers for the individual bits of a bit-blasted concrete semantics [11,12]. They used bit-blasting to express a bit-precise concrete semantics for a statement or basic block.…”

“…We explored how to address these issues using two existing abstract domains for affine-relation analysis (ARA)-one defined by Müller-Olm and Seidl (MOS) [19,21] and one defined by King and Søndergaard (KS) [11,12]-as well as a third domain of affine generators that we introduce. (Henceforth, the three domains are referred to as MOS, KS, and AG, respectively.)…”

“…-To apply the techniques described in the two King and Søndergaard papers [11,12], it is necessary to perform bit-blasting. Their goal is to create implementations of operations that are precise, modulo the inherent limitations of precision that stem from using KS.…”