Structuring abstract interpreters through state and value abstractions

Abstract

We present a new modular way to structure abstract interpreters. Modular means that new analysis domains may be pluggedin. These abstract domains can communicate through different means to achieve maximal precision. First, all abstractions work cooperatively to emit alarms that exclude the undesirable behaviors of the program. Second, the state abstract domains may exchange information through abstractions of the possible value for expressions. Those value abstractions are themselves extensible, should two domains require a novel form of cooperation. We used this approach to design eva, an abstract interpreter for C implemented within the Frama-C framework. We present the domains that are available so far within eva, and show that this communication mechanism is able to handle them seamlessly.