Temporal Abstract Interpretation. To have a continuum of program analysis techniques ranging from model-checking to static analysis.

Transcription

1 Temporal Abtract Interpretation Patrick COUSOT DI, École normale upérieure 45 rue d Ulm Pari cedex 05, France mailto:patrick.couot@en.fr couot and Radhia COUSOT LIX École polytechnique & CNRS Palaieau cedex, France mailto:rcouot@lix.polytechnique.fr rcouot To have a continuum of program analyi technique ranging from model-checking to tatic analyi. 27 th ACM Principle of Programming Language Boton, MA, USA Wedneday January 19 th,2000 P.Couot &R.Couot 2 POPL 00,January19 th,2000 Model-checking veru tatic analyi 1. Objective Both model-checking and tatic analyi are ound; Model-checking i eemingly complete (wherea tatic analyi i not); Abtract interpretation i ueful to undertand the approximation which are involved in both cae and to generalize; Ueful ince preent-day abtract model-checking i not general enough: e.g. tate-to-tate abtraction doe not fit for polyhedral model-checking. P.Couot &R.Couot 1 POPL 00,January19 th,2000 P.Couot &R.Couot 3 POPL 00,January19 th,2000

2 What i in the paper? We introduce a new temporal calculu, the reverible µ -calculu (generalizing known calculi/logic); We tudy it abtract interpretation (in a very general etting i.e. for any emantic and (co-)abtraction); Surpriingly, we how that it model-checking abtraction i incomplete (even for finite tate model); We tudy ufficient completene condition (e.g. the CTL ubcalculu i complete but not CTL ); We conider application to abtract model checking and dataflow analyi. P.Couot &R.Couot 4 POPL 00,January19 th, Abtract interpretation: abtraction/ concretization P.Couot &R.Couot 6 POPL 00,January19 th,2000 What i in thi talk? Afewintuitiveideatohelpreadthepaper. An example of abtraction: (cont d) aequenceofetoftate aetofequenceoftate can be abtracted/approximated by / P.Couot &R.Couot 5 POPL 00,January19 th,2000 P.Couot &R.Couot 7 POPL 00,January19 th,2000

3 An example of abtraction: (cont d) aetofequenceoftate aequenceofetoftate Set-baed abtraction Let u call thi abtraction the et-baed abtraction: can be abtracted/approximated by / α γ P.Couot &R.Couot 8 POPL 00,January19 th,2000 P.Couot &R.Couot 10 POPL 00,January19 th,2000 Concretization Abtraction in general The concretization contain all original trace: plu (unrealitic) additional one (,,,,... ); Approximation from above (more trace than poible); The additional trace would yield the ame abtraction anyway! P.Couot &R.Couot 9 POPL 00,January19 th,2000 Abtraction can alo be undertood a chooing an abtract world a a ubet of the concrete world (more preciely a a Moore family). Then: - The expreible concrete propertie are cloed/invariant under the abtraction o can be tated exactly in the abtract world; - The inexpreible concrete propertie have to be upperor lower-approximated by (preferably the bet poible) abtract property; The abtract world i cloed under join, meet, fixpoint, etc. P.Couot &R.Couot 11 POPL 00,January19 th,2000

4 3. Temporal logic/calculi involve implicit abtraction 4. Abtract interpretation: oundne/ completene P.Couot &R.Couot 12 POPL 00,January19 th,2000 P.Couot &R.Couot 14 POPL 00,January19 th,2000 Implicit temporal abtraction In general, temporal-logic/calculi cannot expre all propertie of model,butonlypecificone(e.g.[1]); The emantic of the temporal-logic/calculu can be undertood a an abtraction of the concrete emantic (arbitrary et of equence of tate); For example Kozen propoitional µ-calculu i cloed for the et-baed abtraction. Reference Intuition for oundne For a given cla of propertie, oundne mean that: Any property (in the given cla) oftheabtractworldmut hold in the concrete world; For the et-baed abtraction: - Example: on any trace, tate a can never be immediately followed by tate b ; - Counter-Example: all trace are infinite ; [1] Emeron, E. & Halpern, J. Sometime and Not Never reviited: On branching time veru linear time. TOPLAS 33 (1986), P.Couot &R.Couot 13 POPL 00,January19 th,2000 P.Couot &R.Couot 15 POPL 00,January19 th,2000

5 Example for unoundne Example for incompletene All abtract trace are infinite but not the concrete one! P.Couot &R.Couot 16 POPL 00,January19 th,2000 All concrete trace are finite but not the abtract one! P.Couot &R.Couot 18 POPL 00,January19 th,2000 Intuition for completene For a given cla of propertie, completene mean that: Any property (in the given cla) oftheconcreteworldmut hold in the abtract world; For the et-baed abtraction: - Example: execution from tate a mut eventually be followed by tate b or c ; - Counter-Example: all trace are finite ; 5. Model/checking i an abtract interpretation P.Couot &R.Couot 17 POPL 00,January19 th,2000 P.Couot &R.Couot 19 POPL 00,January19 th,2000

6 Model-checking Univeral model-checking check that: Model Temporal pecification Le frequently, we alo have the dual exitential modelchecking: Model Temporal pecification P.Couot &R.Couot 20 POPL 00,January19 th,2000 Univeral model-checking i a Galoi connection: Set of trace, {ff, tt}, = Dually, exitential model-checking i alo a Galoi connection; In abtract interpretation theory, Galoi connection formalize the notion of dicrete approximation; The model-checking algorithm can be contructively derived by abtract interpretation of the temporal logic/calculu emantic. P.Couot &R.Couot 22 POPL 00,January19 th,2000 γ M α M Model-checking i a boolean abtraction Knowing only whether or not a pecification ϕ i atified by all trace of a model M iabooleanabtraction (a lo of information): α M (ϕ) =(M ϕ) The concretization i the model atifying the pecification: γ M (ff) = γ M (tt) = M Relative completene The completene reult for the model-checking abtraction i relative to the emantic of the temporal logic/calculu! So completene i relative to the abtract world of the temporal logic/calculu emantic not to the concrete world of arbitrary et of trace! Thi implicit abtraction i itelf incomplete (e.g. for the reverible µ -calculu, even for finite tate model); Intuition: with general temporal pecification, model-checking algorithm cannot deal with et of tate only and would have to handle et of trace (too cotly). P.Couot &R.Couot 21 POPL 00,January19 th,2000 P.Couot &R.Couot 23 POPL 00,January19 th,2000

7 Arbitrary et of trace Relative completene incomplete ound α t implicit temporal abtraction Temporal calculu emantic trace complete ound α m modelchecking abtraction Modelchecking algorithm Semantic domain of the reverible µ -calculu The emantic of a formula of the reverible µ -calculu i a et of infinite time-ymmetric trace; An infinite time-ymmetric trace i, σ : tate σ-2 σ-1 σ0 σ1 σ2 σ3 σ4 σi i time origin preent time pat future P.Couot &R.Couot 24 POPL 00,January19 th,2000 P.Couot &R.Couot 26 POPL 00,January19 th,2000 The reverible µ -calculu 6. A few word on the reverible µ -calculu ϕ ::= σ S S (S) tate predicate π t t (S S) tranition predicate ϕ 1 next ϕ 1 reveral ϕ 1 ϕ 2 dijunction ϕ 1 negation X X X variable µ X ϕ 1 leat fixpoint ν X ϕ 1 greatet fixpoint ϕ 1 : ϕ 2 univeral tate cloure P.Couot &R.Couot 25 POPL 00,January19 th,2000 P.Couot &R.Couot 27 POPL 00,January19 th,2000

8 Tranition predicate π t Abbreviation (example) The tranition predicate π t denote all trace with a tranition t from current to next tate:??????????? t ϕ 1 U ϕ 2 = µ X (ϕ2 (ϕ 1 X)) ϕ 1 S ϕ 2 = (ϕ1 Uϕ 2 ) until ince current tate next tate P.Couot &R.Couot 28 POPL 00,January19 th,2000 P.Couot &R.Couot 30 POPL 00,January19 th,2000 Trace reveral: Reveral Univeral tate cloure The univeral tate cloure ϕ 1 : ϕ 2 i the et of trace of ϕ 1 uch that all trace in ϕ 1 with the ame current tate belong to ϕ 2 ; = σi -i i σ4 σ3 σ2 σ1 σ0 σ-1 σ-2 Model reveral: ( σ-2 σ-1 σ0 σ1 σ2 σ3 σ4 σi ) M = { i, σ i, σ M} b b a a ϕ 1 ϕ ϕ 1 2 b c ϕ 2 : P.Couot &R.Couot 29 POPL 00,January19 th,2000 P.Couot &R.Couot 31 POPL 00,January19 th,2000

9 Subcalculi (example: Kozen propoitional µ-calculu) ϕ ::= σ S ϕ 1 ϕ 2 ϕ 1 ϕ 2 ϕ 1 ϕ 1 ϕ 1 where: X µ X ϕ 1 ν X ϕ 1 τ : tranition relation (program SOS emantic); 7. Concluion ϕ 1 = πτ : ϕ 1 alway (after next tep); ϕ 1 = πτ : ϕ 1 ometime (after next tep). P.Couot &R.Couot 32 POPL 00,January19 th,2000 P.Couot &R.Couot 34 POPL 00,January19 th,2000 On the reverible µ -calculu More in the paper Generalization of previou temporal logic and calculi; Contrary to previou propoition: - Every logical tatement i explicit (e.g. no implicit underlying Kripke tructure), - Aingletemporaloperator to handle pat and future, - Completely time-ymmetric, - Model-checking of the full calculu i incomplete (complete for ubcalculi e.g. CTL veru CTL. Compoitional abtract interpretation of generic µ-calculi (independently of a particular emantic, including for non-monotone operator); Study of the model-checking abtraction; Study of (ufficient) abtraction completene condition; Identification of model-checking complete ubcalculi; Application to: - Abtract model checking; - Dataflow analyi (and the oundne of live variable). P.Couot &R.Couot 33 POPL 00,January19 th,2000 P.Couot &R.Couot 35 POPL 00,January19 th,2000

10 Perpective Model-checking i an incomplete abtract interpretation; So for infinite tate ytem and more general temporal logic: - other abtraction can be ued (e.g. not boolean, not tateto-tate, a in abtract teting); - becaue of incompletene, the uual model-checking algorithm are not the mot precie poible one, o other algorithm hould be ued [1]. Reference [1] P. Couot and R. Couot. Abtract interpretation and application to logic program. Journal of Logic Programming,13(2 3): ,1992. P.Couot &R.Couot 36 POPL 00,January19 th,2000 The End P.Couot &R.Couot 37 POPL 00,January19 th,2000