A Galois Connection Calculus for Abstract Interpretation∗
Total Page:16
File Type:pdf, Size:1020Kb
A Galois Connection Calculus for Abstract Interpretation⇤ Patrick Cousot Radhia Cousot CIMS⇤⇤, NYU, USA [email protected] CNRS Emeritus, ENS, France s [email protected] rfru Abstract We introduce a Galois connection calculus for language independent 3. Basic GC semantics Basic GCs are primitive abstractions of specification of abstract interpretations used in programming language semantics, properties. Classical examples are the identity abstraction 1[ , formal verification, and static analysis. This Galois connection calculus and its type λ Q . Q S hC system are typed by abstract interpretation. ] , , , , the top abstraction [ , vi hC vi −− − λ − −P − − −. − −P !−!− − hC vi S > hC Categories and Subject Descriptors D.2.4 [Software/Program Verification] λ Q . J General Terms Algorithms, Languages, Reliability, Security, Theory, Verification. , ] , , > , , the join abstraction [C] vi K> hC vi −−−−−λ P . hC vi S J[ Keywords Abstract Interpretation, Galois connection, Static Analysis, Verification. −−−−−!γ} > }(}(C)), }(C), with ↵}(P ) P , γ}(Q) In Abstract , } , , 1. Galois connections in Abstract Interpretation h K ✓i −−! −−↵ h ✓i J K interpretation [3, 4, 6, 7] concrete properties (for example (e.g.) }(Q), the complement abstraction [C] , }(SC), ¬ of computations) are related to abstract properties (e.g. types). The S ¬ h ✓i −−! −¬ }(C), , the finite/infinite sequence abstraction [C] , abstract properties are always sound approximations of the con- h ◆i γ S 1 1 J K crete properties (abstract proofs/static analyzes are always correct }(C1), }(C), with ↵1(P ) , σi σ P i h ✓i ↵ −1 −− h ✓i { | 2 ^ 2 in the concrete) and are sometimes complete (proofs/analyzes of −− − −! J K dom(σ) and γ1(Q) , σ C1 i dom(σ):σi Q , the abstract properties can all be done in the abstract only). E.g. types } { 2 |8 2 2 }γ transformer abstraction [C1,C2] , }(C1 C2), are sound but incomplete [2] while abstract semantics are usually S h ⇥ ✓i −− ↵ − − −! −− complete [9]. The concrete domain , and abstract domain }(C1) [ }(C2), ˙ mapping relations to join-preserving hC vi h ! ✓i , 4 of properties are posets (partial orders being interpreted as transformers with ↵ (R)J λ X . yK x X : x, y R , hA i , { |9 2 h i2 } implication). When concrete properties all have a 4-most precise γ (g) , x, y y g( x ) , the function abstraction abstraction, the correspondence is a Galois connection (GC) , {h i| 2 { } } γ7! γ hC [C1,C2] , }(C1 C2), }(C1) }(C2), , with abstraction ↵ and concretiza- S 7! h 7! ✓i ↵ −7! −− h 7! vi −↵ hA 4i 2C7! A −− − ! ! ˙ with ↵7!(P ) λ X . f(x) f P x X , γ7!(g) tion γ satisfying P : Q : ↵(x) 4 y ✓i , { | 2 ^ 2 } , x γ(2y)A( 7!expresses C soundness8 2 andC 8 best2A abstraction). Each, fJ C1 KC2 X }(C1): x X : f(x) g(X) , v ) ( { 2 7! |8 2 8 2 2 γ⇥ } adjoint ↵/γ uniquely determines the other γ/↵.AGalois retrac- the cartesian abstraction [I,C] , }(I C), S ⇥ h 7! ✓i ↵−− tion (or insertion) has ↵ onto, so γ is one-to-one, and ↵ ◦ γ is the −−!⇥ identity. E.g. the interval abstraction [3, 4] of the power set }(C) I }(C), ˙ with ↵⇥(X) , λ i I . x C f I h 7! ✓i J K2 { 2 |9 2 7! of complete -totally ordered sets C , is I[ C, C : f[i x] X , γ⇥(Y ) , f i I : f(i) Y (i) , and I 2 } { |8 2 2 } γ [{−1 1} S h the pointwise extension ˙ of to I, etc. , , ] , }(C), I(C , , ), with ✓ ✓ −−−I i 1 1 h ✓i −− −↵ !−! h [{−1 1} J i 4. Galois connector semantics Galois connectors build a GC ↵I(X) [min X, max X], min , max , γI([a, b]) , ; , 1 ; , 1 from GCs provided as parameters. Unary Galois connectors in- x CK a x b , intervals I(C , F, ) γ , { 2 | } S [{−1 1} , clude the reduction connector R[ , , 4 ] , [a, b] a C b C a b [ , ] , γ S hC vi ! −↵ hA i { | 2 [{−1}^ 2 [{1}^ }[{1 1 } , ↵(P ) P , and the pointwise connec- and inclusion [a, b] [c, d] c a b d.AGalois isomor- ↵ 4 , J K hC vi −− −− !−! h{ γ| 2C} i λ ⇢ γ ⇢ γ ^ J . K◦ phism , , has both ↵ and γ bijective. E.g. global tor X C, A, 4 , X C, ˙ ↵ 4 −↵ λ −⇢ −. −↵ −⇢ −− hC ✓i −− − −!−! − hA i S h vi ! h i h 7! vi −− − − − −◦ −! and local invariants areF isomorphic by the right image abstraction ˙ ˙ ˙ γy X A, 4 for the pointwise orderings and 4. Binary Ga- ˙ h 7! i v γ1 y[L, ] , }(L ), L }( ), with lois connectorsJ _ include the compositionK connector , S M h ⇥M ✓i −− − ↵ − −y − !−!− − h 7! M ✓i S hC ✓i −−↵1 y y γ2 −−! ↵ (P ) , λ ` . m `, m P , γ (Q) , `, m m 1, 2, 3, 1, = 2, , b ↵ 4 , ( b ? J ˙K { |h i2 } {h i| 2 hA γ i γhA vi −−2 hA i hA i hA vi hC Q(`) , and is the pointwise extension of inclusion . 1◦ 2 −−! J 3, ⌦ (where ⌦ is a static error), the prod- } ✓ ✓ ↵ ↵ 4 : ) GC ✓i −−−−2◦ 1 hA i γ γ 2. Equivalent formalizationsγ of -based Abstract Interpre- −−−−!# 1 K 2 , , uct connector 1, 1, * 2, b 2, tation GCs ↵ 4 are Galois retracts of/Galois iso- S hC ✓i −−↵1 hA vi hC i −−↵2 hA hC vi − hA i −−!γ1 γ2 −−! ! ⇥ morphic to numerous equivalent mathematical structures [6] such 4 , 1 2, b 1 2, 4 (gen- ↵ − − −↵ −− as join-preserving maps (↵), meet-preserving maps (γ), upper- i hC ⇥CJ ✓⇥ i −− −1 −⇥ − !2 hA ⇥A v⇥ i eralizing to tuples), the higher-order functional connector 1, γ γ closures (γ ◦ ↵), Moore families ( γ(Q) Q ), Sierpi´nski 1 2 S hC { | 2A} K 1, = 2, 4 2, 6 , 1 2, topologies [5]( γ(Q) Q where is unique complemen- ✓i −−↵1 hA vi ) hC i −−↵2 hA i hC ! C {¬ | 2A} ¬ −−!λ g . γ2 g ↵1 −−! 1 principal downset families ◦ ◦ J tation in the concrete domain , if any), 4˙ 1 2, 6˙ for increasing maps and C λ −f −. −↵ − −f − −γ −− ( vγ(Q) Q where vx y y x ), maximal i −− − − − −2 −◦ −◦ − !1 Z hA !1 A i K , ˙ ˙ convex{# congruences| 2A}( P # ↵(P{)=2C|↵(γ(Qv)) } Q , pointwise orderings and 6. {{ 2C| }| 2A} v soundness relations (also called abstraction relation, logical rela- 5. Galois connection calculus The GC calculus G (to specify tion, or tensor product, ↵ 4 = P, Q ↵(P ) 4 Q = P, verifiers/analyzers compositionally) is x,... X for program 1 {h i| } {h 2 Q P γ(Q) = γ− where f x, f(x) x variables, `,... L for labels, e E for elements e ::= true i| v } v ⌘{h i| 2 2 2 | dom(f) , r r0 = x, z y : x, y r y, z r0 ), 1 x ` e ..., s S for sets s ::= B Z X L } {h #i|9 h i2 ^h i2 } |1| | |− | 2 | | | | and, for powersets = }(C), = }(A), polarities of rela- e [e, e] I(s, o) s1 s s s s s s }(s) ..., C # A tions (γ(Q)= x C y Q : R(x, y) where R = x, o{ }|O for| partial orders| o| ::=[ | 7! | ⇥ | | = # { 2 |8 2 } {h 21 )|,||✓| | | y x γ( y ) ). o− o1 o2 o˙ o¨ ..., p P for posets p ::= s, o , and i| 2 { } } g G| for⇥GCs|g ::=| 1|[p] [2p, e] I[p, e, e] [s,h s] i [s] ⇤ See the auxiliary materials. ⇤⇤ Work supported in part by the CMACS NSF award 0926166. > y F [ Permission to make digital or hard copies of part or all of this work for personal or classroom use 2[s] [s] [s, s] [|s, s] [|s, s] ... | R[g] s| g | is granted without fee provided that copies are not made or distributed for profit or commercial ¬ | 1 | | 7! | ⇥ | | | | advantage and that copies bear this notice and the full citation on the first page. Copyrights for third- g g g * g g = g .... The semantics of interval sets is party components of this work must be honored. For all other uses, contact the owner/author(s). | | ) | POPL ’14, January 22–24, 2014, San Diego, CA, USA. Copyright is held by the owner/author(s). I(C, ) ( C C ? [a, b] a, b C : !) where ! S 4 , 4 ✓ ⇥ { 4 | 2 } _ ACM 978-1-4503-2544-8/14/01. http://dx.doi.org/10.1145/2535838.2537850 is# a dynamic error (maybeZ not detectable by typing). J K 6. Abstraction Papers in semantics, verification, and static Ignoring error propagation, S s1 seq S s , S s1 s2 , 7! , analysis can be understood by extracting the semantic domain S s1 S s2 , S s1 s2 S s1 S s2 , S }(s) P S s . ⇤! ⇥ , ⇤ , and GC which are used. For the interval example [3, 4, p. 247], For orders and posets, O o o, o , , , , = , J K, 2J {K)J, ✓ K } the semantic domain , }(⌃1) is that of (nonempty) sets of ˙ S OJ K , ,...,J K O o¨J , ((OKo )),J andK P Js,K o J, S sK ~ O oJ .K nonempty finite or infinite sequences of states in ⌃ , L ✓ h i ⇥M For GCs, T 1[p] , P p J KP p , T y[sL,s ] , P(S sL made of a control state in L and a memory state in X ! M , S S S ˙ T S ⇤ M 7! V JFKs ) ~ ! JsKL PJ Ks ~ J, [sK] , PJ (KP sJ )K~ mapping variables X to a complete total order , (e.g. Z, M ✓ ⇤! M ✓ [ 1 hV i h P S s , T [s] P S s P S s − , 6 or [minint, maxint], 6 ).