A Static Analyzer for Large Safety-­Critical Software Presented by Dario Bösch, ETH Zürich Research Topics in Software Engineering Dario Bösch Bruno Blanchet Laurent Mauborgne Patrick Cousot Antoine Miné Radhia cousot David Monniaux Jérôme Feret Xavier Rival

Example 2Research Topics in Software EngineeringDario Bösch void foo(int n){ int x = 0; while(x <= n){ x++; } assert(x >= n); }

Static Analysis 3Research Topics in Software EngineeringDario Bösch Analyze Code before Execution Allows: Optimizations Documentation Validation

Abstract Interpretation 4Research Topics in Software EngineeringDario Bösch Map variable values to abstract domain Example: Interval Domain int x = -1; if(…){ x = 1; } return 1 / x; concrete abstract γ α [-1,-1] [1,1] [-1,1]

Overview 5 General Static Analyzer using Abstract Interpretation Static Analyzer for Safety – Critical Software Static Analyzer for Large Safety- Critical Software Commercially available in 2002 Paper from 2002 This Paper Research Topics in Software EngineeringDario Bösch

Analyzer in Research Topics in Software EngineeringDario Bösch Analyzer Automated Performance vs. Precision Optimizations

Goal & Specifications 7Research Topics in Software EngineeringDario Bösch Goal: Automated verification of large safety – critical code Specification: C code, but: No Recursion No Gotos No dynamic memory allocation Never aborting execution

Requirements 8Research Topics in Software EngineeringDario Bösch Precision Efficiency CorrectnessAutomationScalability

Manipulations of the Program 9Research Topics in Software EngineeringDario Bösch 132’000 LOC smaller file Constant Propagation Ignoring Functions & Variables Constant Propagation Ignoring Functions & Variables Preprocess & Merge

Iterative Construction 10Research Topics in Software EngineeringDario Bösch 1: Static Analysis 2: Manual Backward Inspection 3: Refinement False alarms Invariants missed or not expressible New domain or parameters

Widening 11Research Topics in Software EngineeringDario Bösch void foo(int n){ int counter = 2*n; for(int i = 0; i < n; i++){ counter--; } return 1/n; } [2n, 2n] [2n-1, 2n-1] [2n-2, 2n-2] [2n-3, 2n-3] [-∞, -∞] Widening [-∞, 2n] Join FALSE ALARM Threshold at 1

Loop Unrolling 12Research Topics in Software EngineeringDario Bösch void foo(int n){ int first = 1; int counter = -n; for(int i = 0; i < n; i++){ if(first){ counter = 1; first = 0; } else counter++; } void foo(int n){ int first = 1; int counter = -n; counter = 1; first = 0; for(int i = 1; i < n; i++){ if(first){ counter = 1; first = 0; } else counter++; } void foo(int n){ int first = 1; int counter = -n; counter = 1; first = 0; for(int i = 1; i < n; i++){ counter++; }

Octagon Abstract Domain 13Research Topics in Software EngineeringDario Bösch void foo(int m, int n, int max){ int left = m – n; int right = m; if(left > max){ right = n + max; } assert(right <= m); } left = m – n && left > max n + max < m right < m Capture linear inequalities:

Abstract Domains 14Research Topics in Software EngineeringDario Bösch Interval Clocked Octagon Ellipsoid Boolean Relation

Storing Abstract Values: Interval 15Research Topics in Software EngineeringDario Bösch One cell for each variable Arrays? One cell for each index (expanded) One cell for whole array (smashed) 14-2 [1,1][4,4][-2,-2] [-2, 4] precise efficient

Storing Abstract Values: Integer cont. 16Research Topics in Software EngineeringDario Bösch {0,2}[0,2] concrete abstract γ α For non-relational domains: + Performance Array Too slow Balanced binary search tree

Storing Abstract Values: Relational 17Research Topics in Software EngineeringDario Bösch Too many variables (relations) Variable Packing: Concentrate on subset

Conclusion 18Research Topics in Software EngineeringDario Bösch Very high precision rate Reasonable power and time consumption Appropriate Abstraction through parameterization

Criticism 19Research Topics in Software EngineeringDario Bösch Good analyzer for the concidered family of programs But a lot of requirements, specifications If these differ: Validations may not work anymore Refinement process needed Eventually new abstract domain needed

Impact 20Research Topics in Software EngineeringDario Bösch 574 Citations Used in framework Astrée (Airbus) Still impact on current papers (2016) Showed that the analyzer can be used for validation Pushed research in this topic