Page 1

The Zonotope Abstract Domain Taylor1+

Khalil Ghorbal, Eric Goubault and Sylvie Putot

CEA, LIST, Modelisation and Analysis of Systems in Interaction

24 avril 2009

Page 2

Outline

1. Introduction

? Numerical domain based on affine forms

? Join over affine forms

? Cyclic iterative schemes

2. Taylor1+

? Implementation details

? Benchmarks

3. Ongoing and future work

Page 3

Numerical abstract domain based on affine forms

(by E. Goubault and S. Putot [5, 6])

Affine forms were introduced by J. L. D. Comba and J. Stolfi

(1993) [2] :

ˆ x = αx

0+

n

?

i=1

αx

i?i

where the real coefficients (αx

and the noise symbols (?i)1≤i≤ntake their values in [−1,1]

? An extension of Interval Arithmetic (IA) that keeps track of

affine relations between values of variables,

i)1≤i≤nare the partial deviations

? A new variable x within [a,b] is abstracted by

ˆ x =1

2(b − a)?1,

? If y = x − x, then Affine Arithmetic (AA) gives“naturally”the

exact answer for y, which is zero, rather than [a −b,b −a] for

IA.

2(a + b) +1

Page 4

Evaluation of binary expressions

? AA is closed under linear transformations, we hence don’t

need linearization (hat := id),

? For non-linear binary operations (×,/), we bound the

non-linear part and add a fresh noise symbol (loss of

information) :

Division if 0 ?∈ γ(ˆ y)

hat(ˆ x/ˆ y) := hat(ˆ x × ˆ y−1),

0+?n

0αy

i=1

Multiplication for ˆ x = αx

i=1αx

i?iand ˆ y = αy

0+?n

n

?

i=1αy

i?i

hat(ˆ x × ˆ y) := αx

0+

n

?

(αx

iαy

0+ αy

iαx

0)?i+

i=1

n

?

j=1

αx

iαy

j?i?j .

Page 5

About multiplication

Straightforward method

n

?

i=1

n

?

j=1

αx

iαy

j?i?j∈

n

?

i=1

αx

iαy

i[0,1] +

n

?

i=1

n

?

j?=i

j=1

αx

iαy

j[−1,1] .

Other methods include the use of SDP solvers (not yet finalized in

the implementation).

Page 6

Join operator (definition)

Definition

The join operation ˆ z = ˆ x ∪ ˆ y defines a minimal upper bound (in

“generic cases”) of ˆ x and ˆ y whose interval concretisation is the

union of the interval concretisations of ˆ x and ˆ y :

αz

αz

0

= mid(γ(ˆ x) ∪ γ(ˆ y))

=

min(αx

= sup(γ(ˆ x) ∪ γ(ˆ y)) − αz

where :

? γ(ˆ x) = [αx

? and mid([a,b]) :=1

? and argmin

a≤x≤b(|x|) := {x ∈ [a,b],|x| is minimal }.

(central value of ˆ z)

(coeff. of ?i)

i

argmin

i,αy

i)≤α≤max(αx

i,αy

i)

0−?

0+?n

(|α|),∀i ≥ 1

i≥1|αz

βz

i|

(coeff. of ?U)

0−?n

i=1|αx

2(a + b),

i|,αx

i=1|αx

i|],

Page 7

Iteration schemes

Definition

Let i and c be any positive integers, ∪ the join operator defined

above. The (i,c,N)-iteration scheme of some functional F is as

follows :

? First unroll i times the Kleene iteration sequence, starting

from ⊥, i.e. compute x1= Fi(⊥),

? Then iterate : xn+1= xn∪ Fc(xn) starting with n = 1,

? End when a fixpoint, say l, is reached before N iterations, else

with ?.

Page 8

Fixpoint computation

Let F be the functional related to the original iterative scheme (a

loop), that we want to analyse, and let X be the fixpoint of the

(i,c,N)-iteration scheme. An upper approximation of the fixpoint

of F is :

?

where X0is the initial state of the original scheme, and F0:= id.

0≤k≤i−1

Fk(X0) ∪

?

0≤l≤c−1

Fl(X),

Page 9

Overview and implementation details

? analyses programs with real number semantics ,

? already implements : a ”join”operator, standard arithmetic

operations (+,−,×,/;√,.−1) .

? APRON like abstract domain (level 0) ,

? written in C and offers an OCAML interface ,

? linked to interproc ,

? uses double-precision floating-point numbers for

computations in abstract domain ,

? partial deviations are encoded as intervals ,

? relies on the interval library of APRON project .

Page 10

Noise symbol semantic

1: A = random ;

2: assume A<=25 and A>=16;

3:

4: xn = 0.0625;

5:i = 0;

6: while ( i <100) do

7:hn = 1 − A∗xn∗xn ;

8: xnp1 = xn + xn ∗(0.5∗hn + 0.375∗hn∗hn );

9:xn = xnp1 ;

10: i = i + 1;

11: done ;

12:

13: z = A∗xn ;

Page 11

init

2 :

4 :

A

xn

=

=

18 + 2?0

0.0625

Page 12

iteration zero

7 :

9 :

hn

xn

=

=

0.9296875 + −0.0078125?0

0.11182 + −5.84603e−4?0+7.15272e−7?1

Page 13

iteration zero

7 :

9 :

hn

xn

=

=

0.9296875 + −0.0078125{c2,it0}

0.11182 + −5.84603e−4{c2,it0} +7.15272e−7{c8,it0}

Page 14

iteration one

hn

=0.7750+ − 0.0226{c2,it0}

+ − 2.8791e−6{c8,it0}

+1.3439e−4{c7,it1}

+ − 0.0036{c2,it0}

+8.0559e−7{c8,it0}

+1.6248e−5{c7,it1}

+1.8153e−5{c8,it1}

xn

=0.1803

Page 15

Comparison of domains on Householder o3 example

Unrolling (5 It.)

Boxes

Octagons

Polyhedra

T.1+ :

• 10 subdivisions

Kleene Iteration

Boxes

Octagons

Polyhedra

T.1+ :

• 10 subdivisions

√A = Axn

[0.51 , 8.44]

[0.51 , 7.91]

[2.22 , 6.56]

[3.97 , 4.51]

[4.00 , 4.47]

√A = Axn

?

?

abort

[1.80 , 4.51]

[1.80 , 4.48]

t(s)

1×10−4

0.01

310

1×10−3

0.02

t(s)

1×10−4

0.04

>24h

0.01

0.2