Refinement-Based Verification for Possibly-Cyclic Lists

Transcription

1 Refiemet-Based Verificatio for Possibly-Cyclic Lists Alexey Logiov 1, Thomas Reps 2, ad Mooly Sagiv 3 1 IBM T.J. Watso Research Ceter; alexey@us.ibm.com 2 Comp. Sci. Dept., Uiversity of Wiscosi; reps@cs.wisc.edu 3 School of Comp. Sci., Tel-Aviv Uiversity; msagiv@post.tau.ac.il Abstract. I earlier work, we preseted a abstractio-refiemet mechaism that was successful i verifyig automatically the partial correctess of i-situ list reversal whe applied to a acyclic liked list [10]. This paper reports o the automatic verificatio of the total correctess (partial correctess ad termiatio) of the same list-reversal algorithm, whe applied to a possibly-cyclic liked list. A key cotributio that made this result possible is a extesio of the fiitedifferecig techique [14] to eable the maiteace of reachability iformatio for a restricted class of possibly-cyclic data structures, which icludes possiblycyclic liked lists. 1 Itroductio Reihard Wilhelm has log bee associated with the Dagstuhl Semiars o Computer Sciece. I March of 2003, the Dagstuhl Semiar Reasoig about Shape was dedicated to oe of the subjects that beefited from importat cotributios o the part of Reihard Wilhelm. Durig that semiar, Richard Borat posed a iterestig challege problem to the authors. The challege cocers the applicatio of the i-situ list reversal procedure Reverse to a pahadle list, i.e., a liked list that cotais a cycle but i which at least the head of the list is ot part of the cycle. (The lists show i Fig. 1 are examples of pahadle lists.) Richard Borat challeged us to use our techiques to demostrate that, whe applied to a pahadle list, Reverse produces a list i which the orietatio of the successor edges i the pahadle (the acyclic part of the list) is as it was i the iput list, while the orietatio of the successor edges o the cycle is reversed. I [10], we preseted a abstractio-refiemet mechaism for use i static aalyses based o 3-valued logic [17], where the sematics of statemets ad the query of iterest are expressed usig logical formulas. Our abstractio-refiemet mechaism itroduces additioal istrumetatio relatios (defied via logical formulas over core relatios, which capture the basic properties of memory cofiguratios). Istrumetatio relatios record auxiliary iformatio i a logical structure, thus providig a mechaism to fie-tue a abstractio: a istrumetatio relatio captures a property that a idividual memory cell may or may ot possess. I geeral, the itroductio of additioal istrumetatio relatios refies a abstractio ito oe that is prepared to track Supported by ONR (N {0708,0796}) ad NSF (CCR ad CCF-{ , }). The work was performed while Logiov was at the Uiversity of Wiscosi.

2 fier distictios amog stores. This allows more properties of the program s stores to be idetified. The abstractio-refiemet mechaism made possible the automatic verificatio of a umber of iterestig properties, icludig the partial correctess of i-situ list reversal whe applied to a acyclic liked list. I our cotext, the sematics of statemets is expressed usig logical formulas that describe chages to core-relatio values. Whe istrumetatio relatios have bee itroduced to refie a abstractio, the challege is to reflect the chages i corerelatio values i the values of the istrumetatio relatios. To address this challege, the authors preseted fiite differecig, a techique that costructs automatically istrumetatio-relatio maiteace formulas, the part of abstract trasformers that deals with istrumetatio relatios [14]. A key aspect of the fiite-differecig techique is its hadlig of reachability istrumetatio relatios, i.e., relatios defied via the trasitive-closure operator. I [14], we adapted a result by Dog ad Su [2] to eable the maiteace of reachability iformatio for acyclic data structures purely i first-order logic, i.e., without the recomputatio of trasitive closure, which geerally results i a loss of precisio. I this paper, we reduce the problem of reachability maiteace for possibly-cyclic lists, e.g., pahadle lists, to the problem of reachability maiteace i acyclic data structures. The essetial problem is that all odes i the cyclic part of a pahadle list look the same i some sese, ad the key to a solutio is fidig a way to break the symmetry of the cycle. (This is discussed further i 3.) The key idea ispired by a similar idea used by William Hesse i his Ph.D. thesis is to break each cycle: we defie a biary istrumetatio relatio sfe to iclude all edges of the data structure, except oe desigated edge o each cycle. We defie a additioal istrumetatio relatio, sfp, to be the reflexive trasitive closure of the acyclic relatio sfe. 4 The relatio sfp ca be maitaied usig our prior results for acyclic reachability maiteace. Reachability iformatio i the actual (possibly-cyclic) data structure ca the be computed based o sfp. This reductio addresses the shortcomig of fiite differecig that preveted our techiques from establishig iterestig properties of programs that maipulate possiblycyclic liked lists. We show that, equipped with the exteded fiite-differecig techique, the abstractio-refiemet mechaism is capable of itroducig istrumetatio relatios that are sufficiet to ecode the key properties of Reverse whe applied to possibly-cyclic liked lists. The cotributios of this paper ca be summarized as follows: We preset a extesio of fiite differecig that allows first-order-logic maiteace of reachability iformatio i possibly-cyclic liked lists. This is achieved via a reductio to the problem of reachability maiteace i acyclic data structures. We demostrate the use of a Data-Structure Costructor for costructig a abstract represetatio of all possibly-cyclic liked lists, icludig pahadle lists. 4 As discussed later, sfe ad sfp stad for spaig-forest edge ad spaig-forest path, respectively.

3 We demostrate the use of automatic abstractio refiemet for itroducig the istrumetatio relatios that are sufficiet for verifyig the partial correctess of Reverse whe applied to ay possibly-cyclic liked list. We preset a simple progress moitor that allows the aalysis to establish the termiatio of Reverse o ay possibly-cyclic liked list. The cotributios fall ito two categories: (i) extedig the scope of fiite differecig so that reachability iformatio ca be maitaied for possibly-cyclic lists, ad (ii) the applicatio of abstractio refiemet for verifyig properties of Reverse. The former cotributio category is discussed i 3. The latter cotributio category is discussed i 6. A advatage of our abstract-iterpretatio approach is that it does ot require the use of a theorem prover. This is particularly beeficial i our settig because our logic is udecidable [5]. 2 Program Aalysis usig 3-Valued Logic I this sectio, we give a brief overview of the framework of parametric shape aalysis via 3-valued logic. For more details, the reader is referred to [17]. x x Fig. 1. Possible stores for pahadle liked lists. (a) A pahadle list poited to byx. We will refer to lists of this shape as type-x lists. (b) A pahadle list poited to by x with y poitig ito the middle of the cycle. We will refer to lists of this shape as type-xy lists. Program states are represeted usig first-order logical structures, which cosist of a collectio of idividuals, together with a iterpretatio for a fiite vocabulary of fiite-arity relatio symbols, R. A iterpretatio is a truth-value assigmet for each relatio symbol for every appropriate-arity tuple of idividuals. To esure termiatio, the framework puts a boud o the umber of distict logical structures that ca arise durig aalysis by groupig idividuals that are idistiguishable accordig to a special subset of uary relatios, A. The groupig of odes is referred to as caoical abstractio ad the set A is referred to as the set of abstractio relatios. The applicatio of caoical abstractio typically trasforms a logical structure S ito a 3-valued logical structure S #, i which the third value, 1/2, deotes the possibility of havig either 0 (false) or 1 (true) i S. A program state is updated ad queried via logical formulas, which are iterpreted over the 3-valued structure S # usig a straightforward extesio of Kleee s 2-valued sematics. Because of caoical abstractio, a idividual i a 3-valued structure ca represet more tha oe idividual i a give 2-valued structure; such a idividual is referred to as a summary idividual. I geeral, a 3-valued logical structure ca represet a ifiite set of 2-valued structures. 3 7 y (a) (b)

4 typedef struct ode { struct ode *; it data; } *List; Relatio Iteded Meaig x(v) Does poiter variablexpoit to memory cell v? (v 1, v 2) Does thefield of v 1 poit to v 2? (a) (b) Table 1. (a) Declaratio of a liked-list datatype i C; (b) core relatios used for represetig the stores maipulated by programs that use typelist. Program states are ecoded i terms of core relatios, C R. Core relatios are part of the uderlyig sematics of the laguage to be aalyzed; they record atomic properties of stores. For istace, Tab. 1 gives the defiitio of a C liked-list datatype, ad lists the core relatios that would be used to represet the stores maipulated by programs that use type List, such as the stores i Fig. 1. Uary relatios represet poiter variables, ad biary relatio represets the field of alist cell. Fig. 2(a) shows 2-valued structure S 2, which represets the store of Fig. 1(a) usig the relatios of Tab. 1. p Iteded Meaig Defiig Formula is (v) Dofields of two or more list odes v 1, v 2: (v 1, v) (v 2, v) v 1 v 2 poit to v? r,x(v) Is v reachable from poiter variablex v 1: x(v 1) (v 1, v) alog fields? c (v) Is v o a directed cycle offields? + (v, v) Table 2. Defiig formulas of istrumetatio relatios commoly employed i aalyses of programs that use type List. The relatio ame is abbreviates is-shared. There is a separate reachability relatio r,x for every program variablex. x u 9 u 8 u 1 u 2 u 3 u 4 u 5 u 6 u 7 (a) x c r,x u 9 c r,x u 8 r,x u 1 r,x u 2 r,x u 3 is c r,x u 4 c r,x u 5 c r,x u 6 c r,x u 7 (b) Fig. 2. A logical structure S 2 that represets the store show i Fig. 1(a) i graphical form: (a) S 2 with relatios of Tab. 1; (b) S 2 with relatios of Tabs. 1 ad 2.

5 The abstractio fuctio o which a aalysis is based, ad hece the precisio of the aalysis defied, ca be tued by (i) choosig to equip structures with additioal istrumetatio relatios to record derived properties, ad (ii) varyig which of the uary core ad uary istrumetatio relatios are used as the set of abstractio relatios. The set of istrumetatio relatios is deoted by I. Each arity-k relatio symbol is defied by a istrumetatio-relatio defiig formula with k free variables. Istrumetatiorelatio symbols may appear i the defiig formulas of other istrumetatio relatios as log as there are o circular depedeces. Tab. 2 lists some istrumetatio relatios that are importat for the aalysis of programs that use typelist. Istrumetatio relatios that ivolve reachability properties, such as relatio r,x (v), ofte play a crucial role i the defiitios of abstractios. These relatios have the effect of keepig disjoit sublists summarized separately. Fig. 2(b) shows 2-valued structure S 2, which represets the store of Fig. 1(a) usig the core relatios of Tab. 1, as well as the istrumetatio relatios of Tab. 2. If all uary relatios are abstractio relatios, the caoical abstractio of 2- valued logical structure S 2 is S 3, show i Fig. 3, with list odes correspodig to u 2 ad u 3 i S 2 represeted by the summary idividual u 2 of S 3 ad list odes correspodig to u 5,..., u 9 i S 2 represeted by the summary idividual u 4 of S 3. S 3 represets ay type-x pahadle list with at least two odes i the pahadle ad at least two odes i the cycle. The followig graphical otatio is used for depictig 3-valued logical structures: x is c r,x r c,x r u r,x 1 u,x 3 u 2 Fig. 3. A 3-valued structure S 3 that is the caoical abstractio of structure S 2. I additio to S 2, S 3 represets ay type-x pahadle list with at least two odes i the pahadle ad at least two odes i the cycle. Idividuals are represeted by circles cotaiig (o-0) values for uary relatios. Summary idividuals are represeted by double circles. A uary relatio p correspodig to a poiter-valued program variable is represeted by a solid arrow from p to the idividual u for which p(u) = 1, ad by the absece of a p-arrow to each ode u for which p(u ) = 0. (If p = 0 for all idividuals, the relatio ame p is ot show.) A biary relatio q is represeted by a solid arrow labeled q betwee each pair of idividuals u i ad u j for which q(u i, u j ) = 1, ad by the absece of a q-arrow betwee pairs u i ad u j for which q(u i, u j ) = 0. Relatios with value 1/2 are represeted by dotted arrows. For each kid of statemet i the programmig laguage, the cocrete sematics is defied by relatio-update formulas for core relatios. The structure trasformers for the abstract sematics are defied by the same relatio-update formulas for core relatios ad relatio-maiteace formulas for istrumetatio relatios. The latter are geerated automatically via fiite differecig [14]. Abstract iterpretatio collects a set of 3-valued structures at each program poit. It is implemeted as a iterative procedure that fids the least fixed poit of a certai set of equatios [17]. Whe the fixed poit is u 4

6 reached, the structures that have bee collected at a program poit describe a superset of all the executio states that ca arise there. Not all logical structures represet admissible stores. To exclude structures that do ot, we impose itegrity costraits. For istace, relatio x(v) of Tab. 1 captures whether poiter variable x poits to memory cell v; x would be give the attribute uique, which imposes the itegrity costrait that x ca hold for at most oe idividual i ay structure: v 1, v 2 : x(v 1 ) x(v 2 ) v 1 = v 2. This formula evaluates to 1 i ay 2-valued logical structure that correspods to a admissible store. Itegrity costraits cotribute to the cocretizatio fuctio (γ) for our abstractio [18]. Itegrity costraits are eforced by coerce, a clea-up operatio that may sharpe a 3-valued logical structure by settig a idefiite value (1/2) to a defiite value (0 or 1), or discard a structure etirely if a itegrity costrait is defiitely violated by the structure (e.g., if the structure caot represet ay admissible store). 3 Reachability Maiteace i Possibly-Cyclic Liked Lists Ufortuately, the relatios defied i Tabs. 1 ad 2 do ot permit precise maiteace of reachability iformatio, such as relatio r,x, i possibly-cyclic lists. A difficulty arises whe reachability iformatio has to be updated to reflect the deletio of a edge o a cycle (e.g., as a result of statemet y-> = NULL). With the relatios defied i Tabs. 1 ad 2, such a update requires the recomputatio of a trasitiveclosure formula, which geerally results i a drastic loss of precisio i the presece of abstractio. u 8 u 1 u 2 u 3 u 4 u 5 u 6 u 7 x y Fig. 4. Logical structure S 4 that represets type-xy pahadle lists, such as the store of Fig. 1(b). The relatios of Tab. 2 are omitted to reduce clutter. Their values are as expected for a type-xy list: r,x holds for all odes, r,y ad c hold for all odes o the cycle, ad is holds for u 3. We demostrate the issue o pahadle lists represeted by the abstract structure S 4 show i Fig. 4, i.e., lists of type XY. Statemet y-> = NULL has the effect of deletig the edge leavig u 5, thus makig the odes represeted by u 6, u 7, ad u 8 ureachable from x. 5 Note that a first-order-logic formula over the relatios of Tabs. 1 ad 2 caot distiguish the list odes represeted by u 4 from those represeted by u 6, u 7, ad u 8 : all of those odes are reachable from both x ad y, oe of those odes are shared, ad all of them lie o a cycle. Our iability to characterize 5 Clearly, all odes except u 5 also become ureachable fromy.

7 the group of odes represeted by u 4 via a first-order formula requires the maiteace formula for the reachability relatio r,x to recompute some trasitive-closure iformatio, e.g., the trasitive-closure subformula of the defiitio of r,x, amely, (v 1, v). However, i the presece of abstractio, recomputig trasitive-closure formulas ofte yields 1/2. For istace, i S 4, formula (v 1, v) evaluates to 1/2 uder the assigmet [v 1 u 1, v u 4 ] because of the may 1/2 values of relatio (see the dashed edges coectig u 1 with u 2, for example). The essece of a solutio that eables maitaiig reachability relatios for possiblycyclic lists i first-order logic is to fid a way to break the symmetry of each cycle. The basic idea for a solutio was suggested to us by William Hesse ad Neil Immerma. It cosists of maitaiig a spaig-tree represetatio of a possibly-cyclic list. Reachability i such a represetatio ca be maitaied usig first-order-logic formulas. Reachability i the actual list ca be expressed i first-order logic based o the spaig-tree represetatio. We ow explai our approach ad highlight some differeces with the approach take by Hesse [4]. Our approach relies o the itroductio of additioal core ad istrumetatio relatios. We exted the set of core relatios (Tab. 1) with uary relatio roc, which desigates oe ode o each cycle to be the represetative of the cycle. (We refer to such a ode as a roc ode.) Relatio roc is used for trackig a uique cut edge o each cycle, which allows the maiteace of a spaig tree. Fig. 5(a) shows 2-valued structure S 5, which represets the store of Fig. 1(a) usig the exteded set of core relatios. Here, we let u 7 be the roc ode. I geeral, we simply require that exactly oe ode o each cycle be desigated as a roc ode. Later i this sectio we describe how we esure this. Tab. 3 lists the exteded set of istrumetatio relatios. Note that relatio roc is ot part of the sematics of the laguage. A atural questio is whether roc (v) ca be defied as a istrumetatio relatio. For istace, we ca try to defie it usig the followig defiig formula: c (v) v 1 : (v 1, v) c (v 1 ) (1) Formula (1) idetifies odes that lie o a cycle but have a predecessor that does ot. There are three problems with this approach. First, this defiitio works for pahadle lists but ot for cyclic lists without a pahadle. (I geeral, o other defiitio ca work for cyclic lists without a pahadle because if oe existed, it would eed to choose oe list ode amog idetical-lookig odes that lie o each cycle.) Secod, because the cyclicity relatio c is defied i terms of roc (ad sfp ), the defiitio of roc has a circular depedece, which is disallowed. (This circularity caot be avoided, if we wat all reachability relatios to beefit from the precise maiteace of oe trasitive-closure relatio here, sfp.) The third problem with itroducig roc as a istrumetatio relatio is discussed later i the sectio (i footote 6). We divide our descriptio of the abstractio based o the ew set of relatios ito three parts, which describe (i) how the relatios of Tab. 3 defie directed spaig forests, (ii) how we maitai precisio o a cycle i the presece of abstractio, ad (iii) how we geerate maiteace formulas for istrumetatio relatios automatically. The three parts highlight the differeces betwee our approach ad that of Hesse.

8 p Iteded Meaig Defiig Formula is (v) Dofields of two or more list odes v 1, v 2: (v 1, v) (v 2, v) v 1 v 2 poit to v? sfe (v 1, v 2) Is there aedge from v 2 to v 1 (v 2, v 1) roc (v 2) (assumig that v 2 is ot a roc ode) sfp (v 1, v 2) Is v 2 reachable from v 1 alog sfe edges? sfe (v1, v2) sfp (v 2, 0 v 1) 1 sfp t (v 1, v 2) Is v 2 reachable from v 1 alogfields? (u, v 1) u, roc (u) (u, w) A sfp (v 2, w) r,x(v) Is v reachable from poiter variablex v 1: x(v 1) t (v 1, v) alog fields? c (v) Is v o a directed cycle offields? v 1, v 2: roc (v 1) (v 1, v 2) sfp (v, v 2) pr x (v) Does v lie o a sfe path fromx(does v v 1: x(v 1) sfp (v 1, v) precedexo a-path to a roc ode)? pr is (v) Does v lie o a sfe path from a shared v 1: is (v 1) sfp (v 1, v) ode (does v precede a shared ode o a-path to a roc ode)? Table 3. Defiig formulas of istrumetatio relatios. The sharig relatio is is defied as i Tab. 2. Relatios r,x ad c are redefied via first-order-logic formulas i terms of other relatios. Defiig Directed Spaig Forests Istrumetatio relatio sfe sfe stads for spaig-forest edge is used to maitai the set of edges that form a spaig forest of list odes. I Hesse s work, the spaig-forest edges retai the directio of the edges. As a result, he maitais spaig forests, i which the edges lead to the roots of the spaig forest, which are desigated as roc odes i our abstractio. For clarity of presetatio, we defie sfe to be the reverse of edges (all but the edges leavig roc odes). The graph defied by the sfe relatio the defies a directed spaig forest with roc odes as spaig-forest roots ad with the usual orietatio of spaigforest edges. Istrumetatio relatio sfp sfp stads for spaig-forest path is used to maitai the set of paths i the spaig forest of list odes. Biary reachability i the actual lists (see relatio t i Tab. 3) ca be defied i terms of, roc, ad sfp usig a first-order-logic formula: v 2 is reachable from v 1 if there is a spaig-forest path from v 2 to v 1 or there is a pair of spaig-forest paths, oe from the source of a cut edge (a roc ode) to v 1 ad the other from v 2 to the target of the cut edge (the-successor of the same roc ode). Uary reachability relatios r,x ad the cyclicity relatio c ca be defied via first-order formulas, as well. We defied r,x i terms of biary reachability relatio t. While we could defie c i terms of t, as well, we chose aother simple defiitio by observig that a ode lies o a cycle if ad oly if there is a spaig-forest path from it to the target of a cut edge (the-successor of a roc ode).

9 Fig. 5(b) shows 2-valued structure S 5, which represets the store of Fig. 1(a) usig the exteded set of core ad istrumetatio relatios. The relatios pr x ad pr is will be explaied shortly. x u 9 u 8 u 1 u 2 u 3 u 7 u 4 u 5 u 6 roc (a) x r,x pr x pr is r,x,c r,x,c pr sfe is pr sfe is u 1 r u 2 u 3 is u 4 u 5 u 6 roc u 7,x r,x r,x,c c c pr pr r pr,x,c sfe is sfe is r,x r,x sfe is sfe sfe sfe u 9 u 8 (b) Fig. 5. A logical structure S 5 that represets the store show i Fig. 1(a) i graphical form: (a) S 5 with the exteded set of core relatios.(b) S 5 with the exteded set of core ad istrumetatio relatios (core relatios appear i grey). Trasitive-closure relatios sfp ad t have bee omitted to reduce clutter. The values of the trasitive-closure relatios ca be readily see from the graphical represetatio of relatios sfe ad. For istace, ode u 5 is related via the sfp relatio to itself ad all odes appearig to the left or above it i the pictorial represetatio. Preservig Node Orderig o a Cycle i the Presece of Abstractio The fact that our techiques eed to be applicable i the presece of abstractio itroduces a complicatio that is ot preset i the settig studied by Hesse. His cocer was with the expressibility of certai properties withi the cofies of a logic with certai sytactic restrictios. Our cocer is with the ability to maitai precisio i the framework of caoical abstractio. Uary reachability relatios r,x (oe for every program variable x) play a crucial role,sfe i the aalysis of programs u r 6 that maipulate acyclic liked,x c r,y lists. I additio to keepig disjoit lists summarized separately, they keep list odes 1 2 is u u u 3 u4 u roc 5 r,x r,x r,x,c r,x,c r,x,c that have bee visited durig a r sfe sfe r r,y,y,y traversal summarized separately,sfe from odes that have ot bee x y visited: if x is the poiter used to traverse the list, the the Fig. 6. A 3-valued structure S 6 that is the caoical abstractio of structure S 4 if relatios pr x ad pr is are ot odes that have bee visited will added to A ad ode u 7 is the roc ode. have value 0 for relatio r,x, while the odes that have ot bee visited will have value 1. If a list cotais a cycle, the all odes o the cycle sfe sfe sfe

10 are reachable from the same set of variables, amely, all variables that poit to ay ode i that list. As a result, the istrumetatio relatios discussed thus far caot prevet odes u 4, u 6, ad u 8 of S 4 show i Fig. 4 from beig summarized together. Thus, assumig that u 7 is the roc ode, the caoical abstractio of S 4 is the 3-valued structure S 6 show i Fig. 6. The odes represeted by u 4, u 6, ad u 8 of S 4 are represeted by the sigle summary idividual u 6 i S 6. The symmetry hides all iformatio about the order of traversal via poiter variable y. Moreover, the values of the sfp relatio (ot show i Fig. 6) lose precisio because acestors of the shared ode i the spaig tree are summarized together with its descedats i the spaig tree. We break the symmetry of the odes o a cycle usig a geeral mechaism via uary properties aki to uary reachability relatios r,x. I the defiitios of relatios pr x of Tab. 3, full reachability (relatio t ) has bee replaced with spaig-forest reachability (relatio sfp ). The relatios pr x distiguish odes accordig to whether or ot they are reachable from program variablexalog spaig-forest edges. The relatio pr is is defied similarly but usig istrumetatio relatio is ; pr is partitios the odes of a pahadle list ito acestors ad descedats of the shared ode i the spaig tree. Fig. 7 shows structure S 7 that is the caoical abstractio of S 4 of Fig. 4, assumig that u 7 is the roc ode. I S 7, each of the odes u 4, u 6, ad u 8 has a distict vector of values for the relatios pr y ad pr is, thus breakig the symmetry. pr y pr is u 8 pr x pr y pr pr y y pr u is pr 1 u is pr 2 u y pr pr 3 u y roc is 4 u 5 u 6 u 7 x Fig. 7. A 3-valued structure S 7 that is the caoical abstractio of structure S 4 if ode u 7 is the roc ode. S 7 represets pahadle lists of type XY, such as the store of Fig. 1(b). The oly istrumetatio relatios show i the figure are pr x, pr y, ad pr is. As i structure S 4 show i Fig. 4, r,x holds for all odes, r,y ad c hold for all odes o the cycle, ad is holds for u 3. y Automatic Geeratio of Maiteace Formulas for Istrumetatio Relatios I his thesis, Hesse gives had-specified update formulas for a collectio of relatios that are used for maitaiig a spaig-forest represetatio of possibly-cyclic liked lists. Istead of specifyig them by had, we rely o fiite differecig to geerate relatiomaiteace formulas for all istrumetatio relatios. Fiite-differecig-geerated maiteace formulas have bee effective i maitaiig all relatios defied via firstorder-logic formulas, i.e., all relatios of Tab. 3 except sfp. Additioally, uder certai coditios, fiite-differecig-geerated maiteace formulas have bee effective i maitaiig relatios defied via the reflexive trasitive closure of biary relatios. The ecessary coditios for this techique to be applicable for the maiteace of relatio sfp are:

11 Acyclicity coditio: the graph defied by sfe eeds to be acyclic; Uit-size-chage coditio: the chage to the graph effected by ay program statemet eeds to be a sigle-edge additio or deletio (but ot both). The acyclicity coditio applies i our settig because the graph defied by sfe defies a spaig forest. The uit-size-chage coditio requires some discussio. The relatio sfe is defied i terms of ad roc. While we have ot yet discussed the relatio-update formulas for core relatio roc, it should be clear that the value of the relatio roc should oly chage i respose to a chage i the value of a ode s field. There are two types of statemets that chage the value of the field ad thus may have a effect that should be reflected i the value of the sfe relatio, amely, statemets of the forms x-> = NULL ad x-> = y. The former destroys the edge leavig the ode poited to by x, ad the latter creates a ew -coectio from the ode poited to by x to the ode poited to by y. While both of these statemets add or remove a sigle edge of the relatio, it is ot ecessarily the case that they add or remove a sigle edge of the sfe relatio. Whe iterpreted o logical structure S 7 of Fig. 7, statemety-> = NULL has the effect of deletig the edge leavig u 5, a actio that should result i the deletio of the sfe edge eterig u 5 (ot show i the figure). However, to preserve the spaig-forest represetatio, we eed to esure that roc holds oly for odes that lie o a cycle ad that sfe represets spaig-forest edges. This requires settig the value of roc for u 7 to 0 ad addig a sfe edge from u 8 to u 7. Because, as this example illustrates, a laguage statemet may result i the deletio of oe sfe edge ad the additio of aother, our techique for maitaiig istrumetatio relatios defied via the trasitive-closure operator does ot apply. To work aroud this problem, we apply each trasformer associated with statemets x-> = NULL adx-> = y i two phases. I oe phase, we apply the part of the trasformer that correspods to the relatio ad reflect it i the values of all istrumetatio relatios. I the other phase, we apply the part of the trasformer that correspods to the relatio roc ad reflect it i the values of all istrumetatio relatios. As we explai below, each phase of the two trasformers satisfies the requiremet that the chage adds a sigle edge or removes a sigle edge of the sfe relatio. 6 Additioally, by payig attetio to the order of phases, we esure that the graph defied by the relatio sfe remais acyclic throughout the applicatio of the trasformers. To preserve the acyclicity coditio i the case of statemet x-> = NULL, we apply the part of the trasformer that correspods to the relatio first: (v 1, v 2 ) = (v 1, v 2 ) x(v 1 ). (2) Ulessxpoits to a roc ode (orx-> isnull), this phase results i the deletio of the sfe edge that eters the ode poited to byx. I the secod phase, we apply the part of the trasformer that correspods to the relatio roc : roc (v) = roc (v) v 1 : (v, v 1 ) sfp (v, v 1 ) (3) 6 The third problem with defiig roc as a istrumetatio relatio (alluded to earlier i the sectio) is that we would lose the ability to apply the two parts of a trasformer separately: the chage i the values of would immediately trigger a chage i the values of roc. The resultig trasformer would ot be able to satisfy the uit-size-chage coditio.

12 This phase sets the roc property of the source s of a cut edge to 0, if there is o loger a spaig-forest path from s to the target t of the same cut edge. Whe this happes adxdoes ot poit to s, i.e., the cut edge is ot beig deleted, this phase results i the additio of a sfe edge from t to s. To preserve the acyclicity coditio i the case of statemetx-> = y, we apply the part of the trasformer that correspods to the relatio roc first: roc (v) = roc (v) (x(v) v 1 : y(v 1 ) sfp (v, v 1 )) (4) If there is a spaig-forest path from ode x, poited to byx, to ode y, poited to by y, the statemet creates a ew cycle i the data structure. The update of Formula (4) sets the roc property of x to 1, thus makig x the source of a ew cut edge ad y the target of the cut edge. Because there was o edge from x to y prior to the executio of this statemet, 7 this phase results i o chage to the sfe relatio. I the secod phase, we apply the part of the trasformer that correspods to the relatio : (v 1, v 2 ) = (v 1, v 2 ) (x(v 1 ) y(v 2 )) (5) Uless the ode poited to byxbecame a roc ode i the first phase, this phase results i the additio of a sfe edge from y to x. The break-up of the trasformers correspodig to statemetsx-> = NULL ad x-> = y ito two phases, as described above, esures that the sfe relatio remais acyclic throughout the aalysis (the acyclicity coditio) ad that the chage to the sfe relatio effected by each phase is a uit-size chage (the uit-size-chage coditio). 8 Thus, it is soud to maitai sfp (= sfe ) via the techiques described i [14]. Additioally, it is also soud to maitai the remaiig istrumetatio relatios via those techiques because the remaiig relatios are defied by first-order-logic formulas. Soudess guaratees that the stored values of istrumetatio relatios agree with the relatios defiig formulas throughout the aalysis. However, the stored values may ot agree with the relatios iteded meaigs. For istace, if the -trasfer phase of the trasformer for statemetx-> = NULL removes a o-cutedge o a cycle, the sfe relatio will temporarily ot spa the etire list. However, as log as we do ot query the results of abstract iterpretatio betwee the phases of a two-phase trasformer, the stored values of istrumetatio relatios agree with the relatios iteded meaigs, as well as their defiig formulas. Optimized Maiteace of Relatio sfp By demostratig that the acyclicity ad uit-size-chage coditios hold for relatio sfe, we were able to rely o the techiques of [14] to maitai the relatio sfp. Note, however, that the defiitio of sfe 7 By ormalizig procedures to iclude a statemet of the formx-> = NULL prior to a statemet of the formx-> = y, we esure thatx-> is alwaysnull prior to the latter assigmet. 8 Esurig the uit-size-chage coditio requires aswerig a questio that is i geeral udecidable. However, we foud that a coservative approximatio based o a sytactic aalysis of logical formulas suffices for the types of aalyses we have performed so far [14].

13 esures that the graph defied by sfe is ot oly acyclic but is tree-shaped. This kowledge has o bearig o the maiteace formulas that reflect a positive uit-size chage + [sfe ] to the sfe relatio i the values of the sfp relatio (see [14, Formula 8]). However, it allows a egative uit-size chage [sfe ] to the sfe relatio to be reflected i the values of the sfp relatio i a more efficiet maer. I a tree-shaped graph, there exists at most oe path betwee a pair of odes; if that path goes through the sfe edge to be deleted, it should be removed (cf. [14, Formula 10]): sfp (v 1, v 2 ) = sfp (v 1, v 2 ) ( v 1, v 2 : sfp (v 1, v 1) [sfe ](v 1, v 2) sfp (v 2, v 2 )). (6) We exteded our fiite-differecig techique with the optimized schema for maitaiig the trasitive closure of a tree-shaped biary relatio i respose to a egative uit-size chage i the relatio. We will refer to the method of [14] as acyclic-sfe maiteace ad the optimized method as tree-shaped-sfe maiteace. 4 Expressig Properties of Trasformatios Whe discussig properties of Reverse, we are iterested i makig assertios that compare the state of a store at the ed of the procedure with its state at the start. For istace, we may be iterested i checkig that all tree odes reachable from variable x at the start of the procedure are guarateed to be reachable from x at the ed. To allow the user to make such assertios, we double the vocabulary: for each relatio p, we exted the program-aalysis specificatio with a history relatio, p 0, which serves as a idelible record of the state of the store at the etry poit. We will use the term history relatios to refer to the latter kid of relatios, ad the term active relatios to refer to the relatios from the origial vocabulary. We ca ow express the property metioed above: v: r,x (v) r 0,x(v). (7) If Formula (7) evaluates to 1, the the elemets reachable from x after the procedure executes are exactly the same as those reachable at the begiig of the procedure. I additio to history relatios, we itroduce a collectio of ullary istrumetatio relatios that track whether active relatios have chaged from their iitial values. For each active relatio p(v 1,..., v k ), the relatio same p () is defied by formula v 1,..., v k : p(v 1,..., v k ) p 0 (v 1,..., v k ). We ca ow use same r,x () i place of Formula (7). Additioally, we itroduce a uary relatio ch which tracks the chages to the sole biary core relatio,. The relatio ch is defied by the formula ch (v) = v 1 : (v, v 1 ) 0 (v, v 1 ); it is ot part of the set of abstractio relatios, A.

14 5 I-Situ List-Reversal Algorithm Fig. 8 shows the list-reversal algorithm that we aalyze. The algorithm performs the reversal i place usig three poiter variables, x, y, ad t. Thefield of list odes is reversed o lies [7] ad [8]. Durig the executio of the statemets o those lies, x poits to the ext ode to be processed, y poits to the ode whose field is reversed, adtpoits to the predecessor of that ode. First, let us cosider how Reverse processes a acyclic list L a with head u 1, poited to byx. Fig. 9 shows a logical structure S 9 that represets a store that arises before lie [7] durig the applicatio of Reverse to L a. At this poit theedges of odes u 1,..., u 3 have bee [1] void reverse(list *x) [2] { List *y = NULL; [3] while (x!= NULL) { [4] t = y; [5] y = x; [6] x = x->; [7] y-> = NULL; [8] y-> = t; [9] } [10] x = y; [11] } Fig. 8. I-situ list reversal algorithm reversed, while the remaiig edges retai their origial orietatio. The statemets o lies [7] ad [8] replace theedge from u 4 to u 5 with aedge from u 4 to u 3. The traversal cotiues util, o the last loop iteratio,tis set to poit to u 7 s predecessor i the iput list,yis set to poit to u 7, adxis set tonull. The subsequet executio of lies [7] ad [8] reverses the remaiigedge. The head of the reversed list is u 7, poited to byy. As i the iput list, o ode lies o a cycle. The last statemet of the procedure (the assigmet o lie [10]) restoresxas the head poiter. The trasformatio described above ca be stated formally usig history relatios as follows: same r,x () same c () v 1, v 2 : (v 1, v 2 ) 0 (v 2, v 1 ). (8) u 1 u 3 u 4 u 5 u 7 t y x Fig. 9. Logical structure S 9 that represets a store that arises prior to lie [7] ofreverse whe the algorithm is applied to a acyclic list. Let us cosider how Reverse processes a list L c that cosists of a sigle cycle without a pahadle, such as the acyclic list L a discussed above, but with a additioal edge from u 7 to u 1. The behavior of Reverse o list L c is early idetical to its behavior o list L a. The outgoig edges are reversed oe at a time util, o the last iteratio, t is set to poit to u 7, y is set to poit to u 1, ad x is set to NULL. The subsequet executio of lies [7] ad [8] reverses the remaiig edge from u 7 to u 1. The head of the reversed list remais u 1, poited to byy. Every list ode still lies o a cycle. The last statemet of the procedure (the assigmet o lie [10]) restoresxas the head poiter. The trasformatio of lists such as L c also obeys the property specified i Formula (8).

15 u 1 u5 u 6 u 7 u 8 u 9 t y x (a) u 1 u 2 u 3 u 4 u 5 u 9 x y t (b) Fig. 10. Logical structures that represet stores that arise prior to lie [7] of Reverse whe the algorithm is applied to a pahadle list. (a) Logical structure that represets a store that arises while Reverse processes odes that lie o the cycle, i.e., after processig odes that lie i the pahadle oce. (b) Logical structure that represets a store that arises while Reverse processes odes that lie o the pahadle for the secod time, i.e., after processig odes that lie o the cycle. Now, we discuss howreverse processes a pahadle list L p. Iitially, the procedure advaces the three poiter variables, x, y, ad t, dow the pahadle, reversig the edges out of y. After the pahadle is processed, the algorithm proceeds with the processig of the cycle. Fig. 10(a) shows a logical structure that represets a store that arises prior to lie [7] whilereverse processes odes that lie o the cycle. Util Reverse completes the processig of the cycle, the steps are idetical to the steps take durig the processig of lists L a ad L c. Note that the orietatio of theedges i the pahadle is reversed whe the loop body is executed withxpoitig to u 5 (while reversig the backedge at the ed of processig the cycle). As a result, the algorithm proceeds alog the reversed edges dow the pahadle, reestablishig the origial orietatio of those edges. Fig. 10(b) shows a logical structure that represets a store that arises prior to lie [7] while Reverse processes pahadle odes for the secod time. Istead of reversig everyedge i the list, as it does for lists L a ad L c, 9 the algorithm reverses the directio of every edge o the cycle but reestablishes the origial directio of the edges i the pahadle. The cyclicity property of all odes remais as it was o iput. The head of the output list remais u 1, poited to by y. The last statemet of the procedure (the assigmet o lie [10]) restoresxas the head poiter. The trasformatio described above ca be stated formally usig history relatios as follows: same r,x () same c () v 1, v 2 : (c 0(v 1) c 0(v 2)) ((v 1, v 2 ) 0 (v 2, v 1 )) (9) (c(v 0 1 ) c(v 0 2 )) ((v 1, v 2 ) 0 (v 1, v 2 )). Note that while the behavior of Reverse o lists cosistig of a cycle without a pahadle ca be described by Formula (8), as we metioed above, it ca also be described by Formula (9). (The case described by formula (c 0 (v 1) c 0 (v 2)) ever arises.) 9 Reversig everyedge of a pahadle list is ot possible because it requires the shared ode (u 5 i Fig. 10) to have two outgoig edges.

16 6 Establishig Properties ofreverse I this sectio we describe how the abstractio-refiemet mechaism preseted i [10] ca be used to verify automatically that Reverse obeys the properties described i the previous sectio. Costructig All Valid Iputs for Reverse To verify that Reverse satisfies the properties discussed i the previous sectio, we eed a collectio of 3-valued abstract iput structures that represet all valid iputs to the procedure. Our methodology for obtaiig values for abstract iput structures is to perform a abstract iterpretatio o a loop that odetermiistically costructs the family of all valid iputs to the program (we call such a loop a Data-Structure Costructor, or DSC). This allows the values of istrumetatio relatios to be maitaied (as iput structures are maufactured from the empty store) rather tha computed; i geeral, this results i more precise values for the istrumetatio relatios without requirig the user to specify iput 3-valued logical structures. [1] List *x = NULL; [3] it sz = [4] sizeof(list); [5] while (?) { [6] List *t = malloc(sz); [11] t-> = x; [12] x = t; [13] } (a) List *x, *y, *h; [1] x = y = h = NULL; [2] it sz = [3] sizeof(list); [4] while (?) { [5] List *t = malloc(sz); [6] // save the last ode [7] if (y == NULL) y = t; [8] // save a ode (or NULL) [9] if (?) h = t; [10] t-> = x; [11] x = t; [12] } [13] // if y ad h are o-null, [14] // this will create a cycle [15] if (y!= NULL) y-> = h; [16] (b) Fig. 11. (a) The Data-Structure Costructor for acyclic liked lists. (b) The Data-Structure Costructor for possibly-cyclic liked lists (icludig acyclic ad pahadle lists). The differeces betwee the two versios appear i bold. Two examples of our methodology are depicted i Fig. 11. The loop o the left odetermiistically costructs a acyclic liked list poited to by x: a list is costructed from tail to head (i.e., most deeply ested ode first); the loop exits after some umber of odes have bee added at the frot of the list. The slight modificatio show o the right odetermiistically costructs a (cyclic or acyclic) liked list poited to by x. This is achieved by settigyto poit to the last list ode o lie [8], odetermiistically settighto poit to some list ode (ornull) o lie [10], ad settigy-> to poit toho lie [16] ifyis o-null (possibly completig a cycle). IfhisNULL, the

17 DSC costructs a acyclic list. If h poits to the head of the list, the DSC costructs a list cosistig of a cycle with o pahadle. If h is either NULL or poits to the head of the list, the DSC costructs a pahadle list. Abstract iterpretatio of the DSC of Fig. 11(b) costructs a abstract represetatio of all liked lists poited to byx. Whe testig the applicatio of a procedure to acyclic lists, we select oly those structures collected at the exit of the DSC that satisfy the followig formula: ( v: r,x (v)) ( v: r,x (v) c (v)) (10) We will refer to iput abstractios satisfyig Formula (10) as type Acyclic. Whe testig the applicatio of a procedure to cyclic lists without a pahadle, we select oly those structures collected at the exit of the DSC that satisfy the followig formula: ( v: r,x (v)) ( v: r,x (v) c (v)) (11) We will refer to iput abstractios satisfyig Formula (11) as type Cyclic. Whe testig the applicatio of a procedure to pahadle lists, we select oly those structures collected at the exit of the DSC that satisfy the followig formula: ( v 1 : r,x (v 1 ) c (v 1 )) ( v 2 : r,x (v 2 ) c (v 2 )) (12) We will refer to iput abstractios satisfyig Formula (12) as type Pahadle. Note that Formulas (10) (12) esure that each of the iput types admits oly o-empty lists. Note also that the three types represet disjoit collectios of data structures. Additioally, the cross product of the set of lists represeted by type Acyclic ad the set of lists represeted by type Cyclic is i a oe-to-oe correspodece with the set of lists represeted by type Pahadle: the acyclic-list compoet correspods to the pahadle of a pahadle list ad the cyclic-list compoet correspods to its cycle. We will make use of these facts i 7. I additio to costructig the valid iputs prior to the first aalysis of Reverse, the DSC is used for costructig refied iputs o every iteratio of abstractio refiemet: after abstractio refiemet itroduces additioal istrumetatio relatios, the abstract iterpretatio of the DSC is performed usig a exteded vocabulary that cotais the ew relatio symbols; the 3-valued structures collected at the exit ode of the DSC become the abstract iput to the origial procedure for the subsequet abstract iterpretatio of the procedure. Note that history relatios (such as r 0,x(v) from 4) are iteded to record the state of the store at the etry poit to the procedure or, equivaletly, at the exit from the DSC. To make sure that these relatios have appropriate values, they are maitaied i tadem with their active couterparts durig abstract iterpretatio of the DSC. Whe abstract iput refiemet is completed, values of history relatios are froze i preparatio for the abstract iterpretatio that is about to be performed o the procedure proper. Abstractio-Refiemet Steps After a abstractio of the appropriate valid iput is costructed by aalyzig the DSC, the abstract iterpretatio collects all structures that arise at all program poits of Reverse. To check if Reverse satisfies the expected

18 properties, we check if all structures collected at the exit of Reverse satisfy the appropriate query (Formula (8) whe testig the applicatio of the procedure to lists represeted by type Acyclic ad Formula (9) whe testig the applicatio of the procedure to lists represeted by type Pahadle; we ca check either query whe testig the applicatio of the procedure to lists represeted by type Cyclic). Both queries (Formulas (8) ad (9)) cotai formula (v 1, v 2 ) 0 (v 2, v 1 ) as a subformula. Because this formula evaluates to 1/2 uder ay assigmet that maps v 1 ad v 2 to the same summary idividual with a 1/2-valued self-loop for the relatio, it should come as o surprise that the first ru of abstract iterpretatio returs a idefiite aswer, whether we are checkig Formula (8) or Formula (9). I [10], we itroduced subformula-based refiemet, which aalyzes the sources of imprecisio i the evaluatio of the query i a structure collected at the exit of a procedure, ad chooses how to defie ew istrumetatio relatios usig subformulas of the query that cotribute to the idefiite aswer. Tab. 4 shows the istrumetatio relatios that are itroduced by subformula-based refiemet after Formula (8) evaluates to 1/2 o a structure collected at the exit of Reverse, give a iput abstractio of either type Acyclic or Cyclic. Colum 2 of Tab. 4 shows the imprecise subformulas that are used to defie ew istrumetatio relatios. To gai precisio improvemets from storig ad maitaiig the ew istrumetatio relatios all occurreces of the defiig formulas for the ew istrumetatio relatios i the query ad i the defiitios of other istrumetatio relatios are replaced with the use of the correspodig ew istrumetatio-relatio symbols. Here, the use of Formula (8) i the query is replaced with the use of the stored value rev 1 (). The the defiitios of all istrumetatio relatios are scaed for occurreces of the defiig formulas for rev 1,...,rev 6. These occurreces are replaced with the ames of the six relatios. I this case, oly the ew relatios defiitios are chaged, yieldig the defiitios give i Colum 3 of Tab. 4. Relatio Imprecise Subformula Defiig formula rev 1() same r,x () same c () v 1, v 2: (v 1, v 2) 0 (v 2, v 1) samer,x () same c () rev 2() rev 2 () v 1, v 2: (v 1, v 2) 0 (v 2, v 1) v 1 : rev 3(v 1) rev 3 (v 1) v 2: (v 1, v 2) 0 (v 2, v 1) v 2 : rev 4(v 1, v 2) rev 4 (v 1, v 2) (v 1, v 2) 0 (v 2, v 1) rev 5(v 1, v 2) rev 6(v 2, v 1) rev 5 (v 1, v 2) (v 1, v 2) 0 (v 2, v 1) (v 1, v 2) 0 (v 2, v 1) rev 6 (v 2, v 1) 0 (v 2, v 1) (v 1, v 2) 0 (v 2, v 1) (v 1, v 2) Table 4. Istrumetatio relatios created by subformula-based refiemet whe the applicatio of Reverse is checked agaist the query expressed i Formula (8) o a iput abstractio of either type Acyclic or Cyclic. Tab. 5 shows the istrumetatio relatios that are itroduced by subformulabased refiemet after Formula (9) evaluates to 1/2 o a structure collected at the exit of Reverse, give a iput abstractio of either type Pahadle or Cyclic. Colum 2 of Tab. 5 shows the imprecise subformulas that are used to de-

19 fie ew istrumetatio relatios. Note that subformulas of acycsame(v 1, v 2 ), i.e., (c 0 (v 1 ) c 0 (v 2 )) ((v 1, v 2 ) 0 (v 1, v 2 )) were ot itroduced. This is because refiemet was triggered by imprecise evaluatio o a structure that had a sigle cocrete idividual i the pahadle. However, relatio rev 3 is capable of maitaiig the key property of odes i the pahadle with eough precisio, so that aother refiemet iteratio is ot required. Colum 3 of Tab. 5 gives the defiitios of the ew istrumetatio relatios after all occurreces of the defiig formulas of ew istrumetatio relatios i the query ad i the defiitios of other istrumetatio relatios have bee replaced with the use of the correspodig ew istrumetatio-relatio symbols. Agai, oly the query ad ew relatios defiitios are chaged. Relatio Imprecise Subformula Defiig formula rev 1() same r,x () same c () v 1, v 2: cycrev(v 1, v 2) acycsame(v 1, v 2) samer,x () same c () rev 2() rev 2 () v 1, v 2: cycrev(v 1, v 2) acycsame(v 1, v 2) v 1 : rev 3(v 1) rev 3(v 1) v 2: cycrev(v 1, v 2) acycsame(v 1, v 2) v 2 : rev 4(v 1, v 2) rev 4(v 1, v 2) cycrev(v 1, v 2) acycsame(v 1, v 2) rev 5(v 1, v 2) acycsame(v 1, v 2) rev 5(v 1, v 2) cycrev(v 1, v 2) (c(v 0 1) c(v 0 2)) rev 6(v 2, v 1) rev 6(v 1, v 2) (v 1, v 2) 0 (v 2, v 1) rev 7(v 1, v 2) rev 8(v 2, v 1) rev 7(v 1, v 2) (v 1, v 2) 0 (v 2, v 1) (v 1, v 2) 0 (v 2, v 1) rev 8(v 2, v 1) 0 (v 2, v 1) (v 1, v 2) 0 (v 2, v 1) (v 1, v 2) Table 5. Istrumetatio relatios created by subformula-based refiemet whe the applicatio of Reverse is checked agaist the query expressed i Formula (9) o a iput abstractio of either type Pahadle or Cyclic. For compactess, we refer to formula (c(v 0 1) c(v 0 2)) ((v 1, v 2) 0 (v 2, v 1)) as cycrev(v 1, v 2) ad to formula (c(v 0 1) c(v 0 2)) ((v 1, v 2) 0 (v 1, v 2)) as acycsame(v 1, v 2). After the itroductio of the ew istrumetatio relatios (Tab. 4 or 5, depedig o the query beig verified), the abstract iterpretatio of the DSC is performed usig a exteded vocabulary that cotais the ew istrumetatio-relatio symbols. The subsequet abstract iterpretatio of Reverse succeeds: i all of the structures collected at the exit, rev 1 () = 1. Establishig that Reverse Termiates We ca establish that Reverse termiates usig a few uary core relatios ad a simple progress moitor. We itroduce a collectio of uary core state relatios, state 0 (v), state 1 (v), ad state 2 (v). 10 Every time the reversal of the poiter of the list ode poited to by y is completed (after lie [8] of Fig. 8), the ode s state is chaged to the ext state. (The state relatios carry o sematics with respect to the poiter values of odes; they simply record the visit couts for each ode.) For each state relatio s, we create a copy of s, which is used to save the values of relatio s at the start of the curretly-processed loop iteratio (after lie [3] of Fig. 8). We give the ew relatios the superscript lh to idicate that they hold the 10 The state relatios are ot added to the set of abstractio relatios, A.