IKOS: A Framework for Static Analysis Based on Abstract Interpretation

Brat, Guillaume; Navas, Jorge A.; Shi, Nija; Venet, Arnaud

doi:10.1007/978-3-319-10431-7_20

Cited by 48 publications

(37 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our deterministic parallel abstract interpreter, which we called Pikos, was built using IKOS [Brat et al 2014], an abstract-interpretation framework for C/C++ based on LLVM.…”

Section: Methodsmentioning

confidence: 99%

“…We have implemented our concurrent fixpoint iteration strategy in a tool called Pikos ( §8). Using a suite of 1017 C programs, we compare the performance of Pikos against the state-of-the-art abstract interpreter IKOS [Brat et al 2014], which uses Bourdoncle's algorithm ( §9). When using 4 cores, Pikos achieves an average speedup of 2.06x over IKOS, with a maximum speedup of 3.63x.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Deterministic parallel fixpoint computation

Kim

Venet

Thakur

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

interpretation is a general framework for expressing static program analyses. It reduces the problem of extracting properties of a program to computing an approximation of the least fixpoint of a system of equations. The de facto approach for computing this approximation uses a sequential algorithm based on weak topological order (WTO). This paper presents a deterministic parallel algorithm for fixpoint computation by introducing the notion of weak partial order (WPO). We present an algorithm for constructing a WPO in almost-linear time. Finally, we describe Pikos, our deterministic parallel abstract interpreter, which extends the sequential abstract interpreter IKOS. We evaluate the performance and scalability of Pikos on a suite of 1017 C programs. When using 4 cores, Pikos achieves an average speedup of 2.06x over IKOS, with a maximum speedup of 3.63x. When using 16 cores, Pikos achieves a maximum speedup of 10.97x.Program analysis is a widely adopted approach for automatically extracting properties of the dynamic behavior of programs [Balakrishnan et al. 2010; Ball et al. 2004;Brat and Venet 2005;Delmas and Souyris 2007;Jetley et al. 2008]. Program analyses are used, for instance, for program optimization, bug finding, and program verification. To be effective, a program analysis needs to be efficient, precise, and deterministic (the analysis always computes the same output for the same input program) [Bessey et al. 2010]. This paper aims to improve the efficiency of program analysis without sacrificing precision or determinism.Abstract interpretation [Cousot and Cousot 1977] is a general framework for expressing static program analyses. A typical use of abstract interpretation to determine program invariants involves:C1 An abstract domain A that captures relevant program properties. Abstract domains have been developed to perform, for instance, numerical analysis [Cousot and HalbwachsEach index i ∈ [1, n] corresponds to a control point of the program, the unknowns X i of the system correspond to the invariants to be computed for these control points, and each F i is a monotone operator incorporating the abstract transformers and control flow of the program. C3 Computing an approximation of the least fixpoint of Eq. 1. The exact least solution of the system can be computed using Kleene iteration starting from the least element of A n provided A is Noetherian. However, most interesting abstract domains require the use of widening to ensure termination, which may result in an over-approximation of the invariants of the program. A subsequent narrowing iteration tries to improve the post solution via a downward fixpoint iteration. In practice, abstract interpreters compute an approximation of the least fixpoint. In this paper, we use "fixpoint" to refer to such an approximation of the least fixpoint.The iteration strategy specifies the order in which the equations in Eq. 1 are applied during fixpoint computation and where widening is performed. For a given abstraction, the efficiency, precision, and determinism o...

show abstract

“…Our deterministic parallel abstract interpreter, which we called Pikos, was built using IKOS [Brat et al 2014], an abstract-interpretation framework for C/C++ based on LLVM.…”

Section: Methodsmentioning

confidence: 99%

mentioning

confidence: 99%

Deterministic parallel fixpoint computation

Kim

Venet

Thakur

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…Currently, SEAHORN employs several SMT-based model checking engines based on PDR/IC3 [16], including SPACER [13], [17] and GPDR [18]. Complementary, SEAHORN uses the abstract interpretation-based analyzer IKOS (Inference Kernel for Open Static Analyzers) [19] for providing numerical invariants. The effectiveness and scalability of SEAHORN are demonstrated by the results of the Software Verification Competition (SV-COMP 2015) [20].…”

Section: Seahorn Verification Frameworkmentioning

confidence: 99%

Algorithmic Logic-Based Verification with SeaHorn

Gurfinkel

2015

2015 17th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC)

View full text Add to dashboard Cite

In this tutorial, I will present SEAHORN, a software verification framework. The key distinguishing feature of SEA-HORN is its modular design that separates the concerns of the syntax of the programming language, its operational semantics, and the verification semantics. SEAHORN encompasses several novelties: it (a) encodes verification conditions using an efficient yet precise inter-procedural technique, (b) provides flexibility in the verification semantics to allow different levels of precision, (c) leverages the state-of-the-art in software model checking and abstract interpretation for verification, and (d) uses Horn-clauses as an intermediate language to represent verification conditions which simplifies interfacing with multiple verification tools based on Horn-clauses. SEAHORN provides users with a powerful verification tool and provides researchers with an extensible and customizable framework for experimenting with new software verification techniques.

show abstract

“…Assignment of an index variable is handled as a removal followed by an introduction. 3 We can discard any ordering that arranges constants in infeasible ways, such as 4 < 3. If we have performed some scalar analysis on the original program, we need only generate orderings which are consistent with the analysis results.…”

Section: Orderingsmentioning

confidence: 99%

Analyzing Array Manipulating Programs by Program Transformation

Cornish

Gange

Navas

et al. 2015

Logic-Based Program Synthesis and Transformation

Self Cite

View full text Add to dashboard Cite

We explore a transformational approach to the problem of verifying simple array-manipulating programs. Traditionally, verification of such programs requires intricate analysis machinery to reason with universally quantified statements about symbolic array segments, such as "every data item stored in the segment A[i] to A[j] is equal to the corresponding item stored in the segment B[i] to B [j]." We define a simple abstract machine which allows for set-valued variables and we show how to translate programs with array operations to array-free code for this machine. For the purpose of program analysis, the translated program remains faithful to the semantics of array manipulation. Based on our implementation in LLVM, we evaluate the approach with respect to its ability to extract useful invariants and the cost in terms of code size. Instructions

show abstract

IKOS: A Framework for Static Analysis Based on Abstract Interpretation

Cited by 48 publications

References 5 publications

Deterministic parallel fixpoint computation

Deterministic parallel fixpoint computation

Algorithmic Logic-Based Verification with SeaHorn

Analyzing Array Manipulating Programs by Program Transformation

Contact Info

Product

Resources

About