CS 357 D Carry Over the Results Into a Different Domain

Abstraction of Physical Systems

Abstraction enables us to do system analysis in one domain and CS 357 D carry over the results into a different domain

Lecture 7 Common abstraction:

analysis results Abstract Interpretation Physical system Mathematical model Introduction modeling we analyze a mathematical model of the system and assume that the physical system behaves similarly.

http://cs357d.stanford.edu/ the justiﬁcation that analysis results can indeed be carried over is necessarily informal, since we cannot establish a formal correspondence between the physical April 24, 2007 system and the mathematical model; we rely on domain experts and experimentation

Lecture 7, April 24 1 CS357D Spring 2007 Lecture 7, April 24 2 CS357D Spring 2007

Mathematical Abstraction Abstract Interpretation (Cousot&Cousot 1977)

The theory of abstract interpretation was introduced by Cousot and analysis results (concrete) (abstract) Cousot (POPL’77); it has been and still is being used in many Mathematical model Mathematical model different settings, ranging from compiler optimization to language semantics analysis, formal verification, and theorem proving. modeling we analyze a, usually simpler, mathematical model of the system and conclude that the more complex From the POPL’77 paper: model has the same properties. “A program denotes computations in some universe of objects. In this case, property preservation can be formally justified since Abstract interpretation of programs consists in using that denotation we can define a formal relationship between the two models. to describe computations in another universe of abstract objects, so that the results of abstract execution give some information about

Here we will be concerned only with this type of abstraction, and in particular the actual computations.” with abstract interpretation, the theory that relates the semantics of systems in different domains.

Lecture 7, April 24 3 CS357D Spring 2007 Lecture 7, April 24 4 CS357D Spring 2007 Abstract Interpretation -- more quotes Abstract interpretation -- more quotes

Cousot & Cousot, Journal of Logic and Computation, 1992: Cousot & Cousot, 1992:

“Abstract interpretation is a method for designing approximate “Theoretical point of view: The purpose of abstract semantics of programs which can be used to gather information interpretation is to design hierarchies of interrelated about programs in order to provide sound answers to questions semantics at various levels of detail.” about their runtime behaviors. These semantics can then be used to design manual proof methods or to specify automatic program analyses.” “Practical point of view: The purpose of abstract interpretation is to design automatic program analysis tools for determining statically dynamic properties of programs.”

Lecture 7, April 24 5 CS357D Spring 2007 Lecture 7, April 24 6 CS357D Spring 2007

Abstract interpretation -- basics Abstract interpretation -- basics

Given: Given: - a concrete system with concrete (standard) semantics - a concrete system with concrete (standard) semantics - some notion of the properties we are interested in - some notion of the properties we are interested in

We have to choose / construct :

1. Abstract domain 2.Correspondence between abstract and concrete objects 3.Abstract semantics

Lecture 7, April 24 7 CS357D Spring 2007 Lecture 7, April 24 8 CS357D Spring 2007 Abstract interpretation -- a simple example Abstract interpretation -- basics

Concrete system : multiplication of integers We have to choose / construct :

Question : are the results of these multiplications 1. Abstract domain less than, equal to, or greater than zero? 2.Correspondence between abstract and concrete objects 3.Abstract semantics Concrete domain: sets of integers ! = 2Z

Extend the semantics of multiplication to multiplication of sets:

S1 x S2 = { n | ∃n1 ∈ S1 , n2 ∈ S2 . n1 x n2 = n }

Example: { 1 , 2 } x { 3 , 4 } = { 3 , 4 , 6 , 8 }

Lecture 7, April 24 9 CS357D Spring 2007 Lecture 7, April 24 10 CS357D Spring 2007

Abstract interpretation -- a simple example Abstract interpretation -- a simple example

Question : are the results of these multiplications Question : are the results of these multiplications less than, equal to, or greater than zero? less than, equal to, or greater than zero?

1. Abstract domain: !A = { neg , zero , pos } 1. Abstract domain: !A = { neg , zero , pos }

!A = { -1 , 0 , 1 }

!A = { !"# , $"%& , '&( }

!A = { ♭ , ♮ , ♯ }

!A = { ! , ☁ , ) }

!A = { * , + , , }

Lecture 7, April 24 11 CS357D Spring 2007 Lecture 7, April 24 12 CS357D Spring 2007 Abstract interpretation -- a simple example Choose an abstract domain

Question : are the results of these multiplications Question : are the results of these multiplications less than, equal to, or greater than zero? less than, equal to, or greater than zero?

1. Abstract domain: !A = { neg , zero , pos } 1. Abstract domain: !A = { neg , zero , pos }

2. Correspondence between abstract and concrete objects

expressed by a concretization function

" : !A # !

Lecture 7, April 24 13 CS357D Spring 2007 Lecture 7, April 24 14 CS357D Spring 2007

Concretization function Abstraction function

$ : ! # !A " : !A # ! { neg , zero , pos } sets of integers sets of integers { neg , zero , pos }

maps concrete objects into abstract objects maps abstract objects to concrete objects

gives meaning to the abstract objects $( { 0 } ) = zero $( S ) = neg if ∀n∈S . n < 0 " ( neg ) = { n ∈ Z | n < 0 } $( S ) = pos if ∀n∈S . n > 0 " ( zero ) = { 0 } $( S ) = ? otherwise ?? " ( pos ) = { n Z | n > 0 } we need another ∈ abstract object to map sets like { 3 , -4 } into

Lecture 7, April 24 15 CS357D Spring 2007 Lecture 7, April 24 16 CS357D Spring 2007 Abstraction function Abstraction function

$ : ! # !A $ : ! # !A sets of integers { neg , zero , pos } sets of integers { ⊥, neg , zero , pos, T }

maps concrete objects into abstract objects maps concrete objects into abstract objects

$( { 0 } ) = zero $( { 0 } ) = zero $( S ) = neg if ∀n∈S . n < 0 $( S ) = neg if ∀n∈S . n < 0 $( S ) = pos if ∀n∈S . n > 0 $( S ) = pos if ∀n∈S . n > 0

$( S ) = T otherwise introduce new abstract object $( S ) = ⊥ if S = ∅ for symmetry also add new T (top) abstract object ⊥ (bottom) $( S ) = T otherwise with meaning with meaning "( T ) = Z "( ⊥ ) = ∅

Lecture 7, April 24 17 CS357D Spring 2007 Lecture 7, April 24 18 CS357D Spring 2007

Abstraction function Concretization function

$ : ! # !A " : !A # ! sets of integers { ⊥, neg , zero , pos, T } sets of integers { ⊥, neg , zero , pos, T }

maps concrete objects into abstract objects maps abstract objects to concrete objects gives meaning to the abstract objects $( S ) = ⊥ if S = ∅ $( { 0 } ) = zero " ( ⊥ ) = ∅ " ( neg ) = { n Z | n < 0 } $( S ) = neg if ∀n∈S . n < 0 ∈ $( S ) = pos if ∀n∈S . n > 0 " ( zero ) = { 0 } $( S ) = T otherwise " ( pos ) = { n ∈ Z | n > 0 } " ( T ) = Z

Lecture 7, April 24 19 CS357D Spring 2007 Lecture 7, April 24 20 CS357D Spring 2007 Abstraction and Concretization function Abstraction function

Z ! = 2 { 3 , 4 } $ Z+ $ : ! # !A " : !A # ! { -7 , -12 , -42 } $ !A abstraction concretization Z- ∅ neg $ pos Z ⊥ $( S ) = ⊥ if S = ∅ " ( ⊥ ) = ∅ $ {-2 , 0 } T - $ zero $( S ) = neg if ∀n∈S . n < 0 " ( neg ) = { n ∈ Z | n < 0 } = Z {-2 , 0 , 14 } size: 5 $( { 0 } ) = zero " ( zero ) = { 0 } {-2 , 0 , 14 , 27 } $ $( S ) = pos if ∀n∈S . n > 0 " ( pos ) = { n ∈ Z | n > 0 } = Z+ $ { 0 } $( S ) = T otherwise " ( T ) = Z

size: uncountable

Lecture 7, April 24 21 CS357D Spring 2007 Lecture 7, April 24 22 CS357D Spring 2007

Concretization function Abstract version of multiplication

! Z = 2 { 3 , 4 } Concrete multiplication: xC : ! x ! # ! Z+ "

{ -7 , -12 , -42 } Example: { 1 , 2 } xC { 3 , 4 } = { 3 , 4 , 6 , 8 } !A Z- " ∅ neg pos " Abstract multiplication: xA : !A x !A # !A Z ⊥ {-2 , 0 } " T zero {-2 , 0 , 14 } size: 5 {-2 , 0 , 14 , 27 }

" { 0 } size: uncountable

Lecture 7, April 24 23 CS357D Spring 2007 Lecture 7, April 24 24 CS357D Spring 2007 Abstract version of multiplication Abstract analysis

> Abstract multiplication: xA : !A x !A # !A Concrete question: n1 x n2 = ? 0 <

xA ⊥ neg zero pos T Procedure: A A Abstract n1 and n2 : n1 = $ ( { n1 } ) n2 = $ ( { n2 } ) ⊥ ⊥ ⊥ ⊥ ⊥ ⊥ A A A A neg ⊥ pos zero neg T Perform abstract multiplication : n = n1 x n2 zero ⊥ zero zero zero zero Concretize nA : S = " ( nA )

pos ⊥ neg zero pos T + if S = Z then n1 x n2 > 0 T ⊥ T zero T T - if S = Z then n1 x n2 < 0

if S = { 0 } then n1 x n2 = 0 if S = Z then we don’t know

Lecture 7, April 24 25 CS357D Spring 2007 Lecture 7, April 24 26 CS357D Spring 2007

Abstract analysis -- Example Abstract analysis -- Observations

n1 = 783,422 > n1 x n2 = ? 0 • The choice of abstract domain was governed by the question. If n2 = 409,312 < the question had been to determine whether the result was even or odd, we would have chosen a different abstract domain A Abstract n1 and n2 : n1 = $ ( { n1 } ) = pos and abstract semantics. A n2 = $ ( { n2 } ) = pos • The concrete domain is a partially ordered set with the subset A A A A Perform abstract multiplication : n = n1 x n2 relation ⊆ as order. = pos xA pos = pos • We can also impose an order