Skip to main content
SpringerLink
Log in

Abstract Interpretation in Industry – Experience and Lessons Learned

  • Conference paper
  • First Online:
Static Analysis (SAS 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14284))

Included in the following conference series:

  • 254 Accesses

Abstract

In this article we will give an overview of the development and commercialization of two industry-strength Abstract Interpretation-based static analyzers, aiT WCET Analyzer and Astrée . We focus on development steps, adaptations to meet industry requirements and discuss criteria for a successful transfer of formal verification methods to industrial usage.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 69.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 89.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Alt, M., Ferdinand, C., Martin, F., Wilhelm, R.: Cache behavior prediction by abstract interpretation. In: Cousot, R., Schmidt, D.A. (eds.) SAS 1996. LNCS, vol. 1145, pp. 52–66. Springer, Heidelberg (1996). https://doi.org/10.1007/3-540-61739-6_33

    Chapter  Google Scholar 

  2. AUTOSAR: AUTOSAR (AUTomotive Open System ARchitecture). http://www.autosar.org

  3. Barr, M.: Bookout v. Toyota, 2005 Camry software Analysis by Michael Barr (2013). http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUBBED.pdf

  4. Bouissou, O., et al.: Space software validation using abstract interpretation. In: Proceedings of the 13thData Systems in Aerospace (DASIA 2009) (2009)

    Google Scholar 

  5. BS EN 50657: Railway applications - Rolling stock applications - Software on Board Rolling Stock (2017)

    Google Scholar 

  6. CENELEC EN 50128: Railway Applications - Communication, Signalling and Processing Systems - Software for Railway Control and Protection Systems (2011)

    Google Scholar 

  7. Certification Authorities Software Team (CAST): Position Paper CAST-32A Multi-core Processors (2016)

    Google Scholar 

  8. Cousot, P., Cousot, R.: Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: Proceedings of the POPL’77, pp. 238–252. ACM Press (1977). http://www.di.ens.fr/~cousot/COUSOTpapers/POPL77.shtml. Accessed Sep 2017

  9. Cousot, P., Cousot, R.: Static determination of dynamic properties of generalized type unions. In: Wortman, D.B. (ed.) Proceedings of an ACM Conference on Language Design for Reliable Software (LDRS), Raleigh, North Carolina, USA, 28-30 March 1977, pp. 77–94. ACM (1977). https://doi.org/10.1145/800022.808314

  10. EASA: AMC-20 - amendment 23 - AMC 20–193 use of multi-core processors (2022)

    Google Scholar 

  11. Ferdinand, C., et al.: Reliable and precise WCET determination for a real-life processor. In: Henzinger, T.A., Kirsch, C.M. (eds.) EMSOFT 2001. LNCS, vol. 2211, pp. 469–485. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45449-7_32

    Chapter  Google Scholar 

  12. Ferdinand, C., Wilhelm, R.: Efficient and precise cache behavior prediction for real-time systems. Real-Time Syst. 17(2–3), 131–181 (1999)

    Article  Google Scholar 

  13. Freescale Inc.: QorIQTM P4080 Communications Processor Product Brief (2008). rev. 1

    Google Scholar 

  14. Giet, J., Mauborgne, L., Kästner, D., Ferdinand, C.: Towards zero alarms in sound static analysis of finite state machines. In: Romanovsky, A., Troubitsyna, E., Bitsch, F. (eds.) SAFECOMP 2019. LNCS, vol. 11698, pp. 3–18. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-26601-1_1

    Chapter  Google Scholar 

  15. IEC 61508: Functional safety of electrical/electronic/programmable electronic safety-related systems (2010)

    Google Scholar 

  16. Infineon Technologies AG: AURIXTM TC27x D-Step User’s Manual (2014)

    Google Scholar 

  17. ISO 26262: Road vehicles - Functional safety (2018)

    Google Scholar 

  18. ISO 26262: Road vehicles - Functional safety - Part 2: Management of functional safety (2018)

    Google Scholar 

  19. ISO 26262: Road vehicles - Functional safety - Part 6: Product development at the software level (2018)

    Google Scholar 

  20. Kaestner, D., Wilhelm, S., Mallon, C., Schank, S., Ferdinand, C., Mauborgne, L.: Automatic sound static analysis for integration verification of AUTOSAR software. In: WCX SAE World Congress Experience. SAE International (2023). https://doi.org/10.4271/2023-01-0591

  21. Karos, T.: The Gauge Domain in Astrée. Master’s thesis, Saarland University (2015)

    Google Scholar 

  22. Kästner, D.: Applying abstract interpretation to demonstrate functional safety. In: Boulanger, J.L. (ed.) Formal Methods Applied to Industrial Complex Systems. ISTE/Wiley, London, UK (2014)

    Google Scholar 

  23. Kästner, D., Ferdinand, C.: Efficient verification of non-functional safety properties by abstract interpretation: timing, stack consumption, and absence of runtime errors. In: Proceedings of the 29th International System Safety Conference ISSC2011. Las Vegas (2011)

    Google Scholar 

  24. Kästner, D., Ferdinand, C.: Proving the absence of stack overflows. In: Bondavalli, A., Di Giandomenico, F. (eds.) SAFECOMP 2014. LNCS, vol. 8666, pp. 202–213. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-10506-2_14

    Chapter  Google Scholar 

  25. Kästner, D., Pister, M., Gebhard, G., Schlickling, M., Ferdinand, C.: Confidence in timing. In: SAFECOMP 2013 Workshop: Next Generation of System Assurance Approaches for Safety-Critical Systems (SASSUR) (2013)

    Google Scholar 

  26. Kästner, D., et al.: Model-driven code generation and analysis. In: SAE World Congress 2014. SAE International (2014). https://doi.org/10.4271/2014-01-0217

  27. Kästner, D., et al.: Meeting real-time requirements with multi-core processors. SAFECOMP 2012 Workshop: Next Generation of System Assurance Approaches for Safety-Critical Systems (SASSUR) (2012)

    Google Scholar 

  28. Kästner, D., et al.: Astrée: proving the absence of runtime errors. In: Embedded Real Time Software and Systems Congress ERTS \(^2\) (2010)

    Google Scholar 

  29. Kästner, D., et al.: CompCert: practical experience on integrating and qualifying a formally verified optimizing compiler. In: ERTS2 2018 - Embedded Real Time Software and Systems. 3AF, SEE, SIE, Toulouse, France (2018). https://hal.inria.fr/hal-01643290, archived in the HAL-INRIA open archive, https://hal.inria.fr/hal-01643290/file/ERTS_2018_paper_59.pdf

  30. Kästner, D., Leroy, X., Blazy, S., Schommer, B., Schmidt, M., Ferdinand, C.: Closing the gap - the formally verified optimizing compiler CompCert. In: SSS 2017: Developments in System Safety Engineering: Proceedings of the Twenty-fifth Safety-critical Systems Symposium, pp. 163–180. CreateSpace (2017)

    Google Scholar 

  31. Kästner, D., Mauborgne, L., Ferdinand, C.: Detecting safety- and security-relevant programming defects by sound static analysis. In: Falk, R., Chan, J.C.B.S. (eds.) The Second International Conference on Cyber-Technologies and Cyber-Systems (CYBER 2017). IARIA Conferences, vol. 2, pp. 26–31. IARIA XPS Press (2017)

    Google Scholar 

  32. Kästner, D., Mauborgne, L., Ferdinand, C.: Detecting spectre vulnerabilities by sound static analysis. In: Anne Coull, R.F., Chan, S. (ed.) The Fourth International Conference on Cyber-Technologies and Cyber-Systems (CYBER 2019). IARIA Conferences, vol. 4, pp. 29–37. IARIA XPS Press (2019). http://www.thinkmind.org/download.php?articleid=cyber_2019_3_10_80050

  33. Kästner, D., Mauborgne, L., Grafe, N., Ferdinand, C.: Advanced sound static analysis to detect safety- and security-relevant programming defects. In: Falk, R., Steve Chan, J.C.B. (eds.) 8th International Journal on Advances in Security. vol. 1 & 2, pp. 149–159. IARIA (2018), https://www.iariajournals.org/security/

  34. Kästner, D., Mauborgne, L., Wilhelm, S., Ferdinand, C.: high-precision sound analysis to find safety and cybersecurity defects. In: 10th European Congress on Embedded Real Time Software and Systems (ERTS 2020). Toulouse, France (2020). https://hal.archives-ouvertes.fr/hal-02479217

  35. Kästner, D., Mauborgne, L., Wilhelm, S., Mallon, C., Ferdinand, C.: Static data and control coupling analysis. In: 11th Embedded Real Time Systems European Congress (ERTS2022). Toulouse, France (2022). https://hal.archives-ouvertes.fr/hal-03694546

  36. Kästner, D., Pohland, J.: Program analysis on evolving software. In: Roy, M. (ed.) CARS 2015 - Critical Automotive applications: Robustness & Safety. Paris, France (2015). https://hal.archives-ouvertes.fr/hal-01192985

  37. Kästner, D., Hümbert, C., Gebhard, G., Pister, M., Wegener, S., Ferdinand, C.: Taming Timing - Combining Static Analysis With Non-intrusive Tracing to Compute WCET Bounds on Multicore Processors. Embedded World Congress (2021)

    Google Scholar 

  38. Kästner, D., Salvi, S., Bienmüller, T., Ferdinand, C.: Exploiting synergies between static analysis and model-based testing (2015). https://doi.org/10.1109/EDCC.2015.20

  39. Langenbach, M., Thesing, S., Heckmann, R.: Pipeline modeling for timing analysis. In: Hermenegildo, M.V., Puebla, G. (eds.) SAS 2002. LNCS, vol. 2477, pp. 294–309. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45789-5_22

    Chapter  Google Scholar 

  40. Li, Y.T.S., Malik, S.: Performance analysis of embedded software using implicit path enumeration. In: Proceedings of the 32nd ACM/IEEE Design Automation Conference, pp. 456–461 (1995)

    Google Scholar 

  41. Limited, M.: MISRA C++:2008 Guidelines for the use of the C++ language in critical systems (2008)

    Google Scholar 

  42. Miné, A.: Static analysis of run-time errors in embedded real-time parallel C programs. Logic. Meth. Comput. Sci. (LMCS) 8(26), 63 (2012)

    MathSciNet  Google Scholar 

  43. Miné, A., Delmas, D.: Towards an industrial use of sound static analysis for the verification of concurrent embedded avionics software. In: Proceedings of the 15th International Conference on Embedded Software (EMSOFT 2015), pp. 65–74. IEEE CS Press (2015)

    Google Scholar 

  44. MISRA (Motor Industry Software Reliability Association) Working Group: MISRA-C:2012 Guidelines for the use of the C Language in Critical Systems. MISRA Limited (2013)

    Google Scholar 

  45. MISRA (Motor Industry Software Reliability Association) Working Group: MISRA-C:2023 Guidelines for the use of the C Language in Critical Systems. MISRA Limited (2023)

    Google Scholar 

  46. Nowotsch, J., Paulitsch, M., Bühler, D., Theiling, H., Wegener, S., Schmidt, M.: Multi-core interference-sensitive wcet analysis leveraging runtime resource capacity enforcement. In: ECRTS 2014: Proceedings of the 26th Euromicro Conference on Real-Time Systems (2014)

    Google Scholar 

  47. Radio Technical Commission for Aeronautics: RTCA DO-178B. Software Considerations in Airborne Systems and Equipment Certification (1992)

    Google Scholar 

  48. Radio Technical Commission for Aeronautics: RTCA DO-178C. Software Considerations in Airborne Systems and Equipment Certification (2011)

    Google Scholar 

  49. Radio Technical Commission for Aeronautics: RTCA DO-333. Formal Methods Supplement to DO-178C and DO-278A (2011)

    Google Scholar 

  50. Reineke, J., Grund, D., Berg, C., Wilhelm, R.: Timing predictability of cache replacement policies. Real-Time Syst. 37(2), 99–122 (2007)

    Article  Google Scholar 

  51. Reineke, J., et al.: A definition and classification of timing anomalies. In: Mueller, F. (ed.) International Workshop on Worst-Case Execution Time Analysis (WCET) (2006)

    Google Scholar 

  52. Rival, X., Mauborgne, L.: The trace partitioning abstract domain. ACM Trans. Program. Lang. Syst. 29(5), 26 (2007). https://doi.org/10.1145/1275497.1275501

    Article  Google Scholar 

  53. Schranzhofer, A., Chen, J.J., Thiele, L.: Timing predictability on multi-processor systems with shared resources. In: Workshop on Reconciling Performance with Predictability (RePP), 2010 (2009)

    Google Scholar 

  54. Shaw, A.C.: Reasoning about time in higher-level language software. IEEE Trans. Softw. Eng. 15(7), 875–889 (1989). https://doi.org/10.1109/32.29487

    Article  Google Scholar 

  55. Software Engineering Institute SEI - CERT Division: SEI CERT C Coding Standard - Rules for Developing Safe, Reliable, and Secure Systems. Carnegie Mellon University (2016)

    Google Scholar 

  56. The MITRE Corporation: CWE – Common Weakness Enumeration. https://cwe.mitre.org. Accessed Sep 2017

  57. Theiling, H.: Extracting safe and precise control flow from binaries. In: Proceedings of the 7th Conference on Real-Time Computing Systems and Applications. Cheju Island, South Korea (2000)

    Google Scholar 

  58. Theiling, H.: ILP-based interprocedural path analysis. In: Sangiovanni-Vincentelli, A., Sifakis, J. (eds.) EMSOFT 2002. LNCS, vol. 2491, pp. 349–363. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45828-X_26

    Chapter  Google Scholar 

  59. Thesing, S.: Modeling a system controller for timing analysis. In: Min, S.L., Yi, W. (eds.) Proceedings of the 6th ACM & IEEE International conference on Embedded software, EMSOFT 2006, 22-25 October 2006, Seoul, Korea, pp. 292–300. ACM (2006). https://doi.org/10.1145/1176887.1176929

  60. Thiele, L., Wilhelm, R.: Design for timing predictability. Real-Time Syst. 28(2–3), 157–177 (2004). https://doi.org/10.1023/B:TIME.0000045316.66276.6e

    Article  Google Scholar 

  61. Transcript of Morning Trial Proceedings had on the 14th day of October, 2013 Before the Honorable Patricia G. Parrish, District Judge, Case No. CJ-2008-7969 (2013). http://www.safetyresearch.net/Library/Bookout_v_Toyota_Barr_REDACTED.pdf

  62. Venet, A.: The gauge domain: scalable analysis of linear inequality invariants (2012). https://doi.org/10.1007/978-3-642-31424-7_15

  63. Wegener, S.: Towards multicore WCET analysis. In: Reineke, J. (ed.) 17th International Workshop on Worst-Case Execution Time Analysis (WCET 2017). OpenAccess Series in Informatics (OASIcs), vol. 57, pp. 1–12. Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, Dagstuhl, Germany (2017). https://doi.org/10.4230/OASIcs.WCET.2017.7, http://drops.dagstuhl.de/opus/volltexte/2017/7311

  64. Wilhelm, R., Reineke, J., Wegener, S.: Keeping up with real time. In: Durak, U., Becker, J., Hartmann, S., Voros, N.S. (eds.) Advances in Aeronautical Informatics, pp. 121–133. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-75058-3_9

    Chapter  Google Scholar 

Download references

Acknowledgment

Many people contributed to aiT and Astrée and their success. We want to thank them all.

Author information

Authors and Affiliations

  1. AbsInt GmbH, Science Park 1, 66123, Saarbrücken, Germany

    Daniel Kästner & Christian Ferdinand

  2. Saarland University, Stuhlsatzenhausweg 69, 66123, Saarbrücken, Germany

    Reinhard Wilhelm

Authors
  1. Daniel Kästner
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Reinhard Wilhelm
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Christian Ferdinand
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Daniel Kästner .

Editor information

Editors and Affiliations

  1. U. Politécnica de Madrid (UPM) and IMDEA Software Institute, Pozuelo de Alarcón, Madrid, Spain

    Manuel V. Hermenegildo

  2. U. Politécnica de Madrid (UPM) and IMDEA Software Institute, Pozuelo de Alarcon, Spain

    José F. Morales

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Kästner, D., Wilhelm, R., Ferdinand, C. (2023). Abstract Interpretation in Industry – Experience and Lessons Learned. In: Hermenegildo, M.V., Morales, J.F. (eds) Static Analysis. SAS 2023. Lecture Notes in Computer Science, vol 14284. Springer, Cham. https://doi.org/10.1007/978-3-031-44245-2_2

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-44245-2_2

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-44244-5

  • Online ISBN: 978-3-031-44245-2

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation