## On the Boolean Algebra of Shape Analysis Constraints (2003)

### Cached

### Download Links

Citations: | 18 - 10 self |

### BibTeX

@MISC{Kuncak03onthe,

author = {Victor Kuncak and Martin Rinard},

title = {On the Boolean Algebra of Shape Analysis Constraints},

year = {2003}

}

### Years of Citing Articles

### OpenURL

### Abstract

Shape analysis is a promising technique for statically verifying and extracting properties of programs that manipulate complex data structures. We introduce a new characterization of constraints that arise in parametric shape analysis based on manipulation of three-valued structures as dataflow facts. We identify an interesting syntactic class of first-order logic formulas that captures the meaning of three-valued structures under concretization. This class is broader than previously introduced classes, allowing for a greater flexibility in the formulation of shape analysis constraints in program annotations and internal analysis representations. Three-valued structures can be viewed as one possible normal form of the formulas in our class. Moreover, we characterize the meaning of three-valued structures under "tight concretization". We show that the seemingly minor change from concretization to tight concretization increases the expressive power of three-valued structures in such a way that the resulting constraints are closed under all boolean operations. We call the resulting constraints boolean shape analysis constraints. The main technical contribution of this paper is a natural syntactic characterization of boolean shape analysis constraints as arbitrary boolean combinations of first-order sentences of certain form, and an algorithm for transforming such boolean combinations into the normal form that corresponds directly to three-valued structures.

### Citations

941 |
A relational model of data for large shared data banks
- Codd
- 1970
(Show Context)
Citation Context ...he use of structures for representing program state has proven useful in the shape analysis [49], Abstract State Machines [7], the Alloy modelling language and analyzer [27], and relational databases =-=[13, 15]-=-. Three-Valued Structures A three-valued structure is a model for Kleene's three-valued logic [32, 44] and di#ers from two-valued structure by the fact that predicates can have three-possible values: ... |

753 |
Introduction to Metamathematics
- Kleene
- 1952
(Show Context)
Citation Context ...ract State Machines [7], the Alloy modelling language and analyzer [27], and relational databases [13, 15]. Three-Valued Structures A three-valued structure is a model for Kleene's three-valued logic =-=[32, 44]-=- and di#ers from two-valued structure by the fact that predicates can have three-possible values: {0}, {1}, and {0, 1}. (The truthvalues {0}, {1}, {0, 1} of three-valued logic are denoted by, respecti... |

642 | Construction of abstract state graphs with PVS
- Graf, Saidi
- 1997
(Show Context)
Citation Context ... lead to the object [8, 16, 23]. Other notations for reasoning about the heap include spatial logic [10, 11, 26, 45] and alias types [50, 51]. It is possible to apply predicate abstraction techniques =-=[2, 3, 22]-=- to perform shape analysis; the view of three-valued structures as boolean combinations of constraints of certain form may be beneficial for this direction of work and enable easier application of rep... |

574 | Parametric shape analysis via 3-valued logic
- SAGIV, REPS, et al.
- 2002
(Show Context)
Citation Context ...boratory Massachusetts Institute of Technology Cambridge, MA 02139, USA {vkuncak,rinard}@csail.mit.edu No Institute Given Abstract. The parametric shape analysis framework of Sagiv, Reps, and Wilhelm =-=[45,46]-=- uses three-valued structures as dataflow lattice elements to represent sets of states at different program points. The recent work of Yorsh, Reps, Sagiv, Wilhelm [48, 50] introduces a family of formu... |

553 |
An Introduction to Database Systems
- Date
- 2000
(Show Context)
Citation Context ...he use of structures for representing program state has proven useful in the shape analysis [49], Abstract State Machines [7], the Alloy modelling language and analyzer [27], and relational databases =-=[13, 15]-=-. Three-Valued Structures A three-valued structure is a model for Kleene's three-valued logic [32, 44] and di#ers from two-valued structure by the fact that predicates can have three-possible values: ... |

420 | Automatic predicate abstraction of C programs
- Ball, Majumdar, et al.
- 2001
(Show Context)
Citation Context ... lead to the object [8, 16, 23]. Other notations for reasoning about the heap include spatial logic [10, 11, 26, 45] and alias types [50, 51]. It is possible to apply predicate abstraction techniques =-=[2, 3, 22]-=- to perform shape analysis; the view of three-valued structures as boolean combinations of constraints of certain form may be beneficial for this direction of work and enable easier application of rep... |

394 | Zadeck, “Analysis of pointers and structures
- Chase, Wegman, et al.
- 1990
(Show Context)
Citation Context ...ts to the satisfiability problem. Keywords: Shape Analysis, Program Verification, Abstract Interpretation, Boolean Algebra, First-Order Logic, Model Checking 1 Introduction Background. Shape analysis =-=[46,32,22,20,12,16,15,9,37,27]-=- is a technique for statically analyzing programs that manipulate dynamically allocated data structures, and is important for precise reasoning about programs written in modern imperative programming ... |

377 |
Cousot and Radhia Cousot. Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints
- Patrick
- 1977
(Show Context)
Citation Context ...pecifications must bridge the gap between the analysis representation and the program annotations. Logic-Based Shape Analysis A promising shape analysis approach [49] based on abstract interpretation =-=[14]-=- uses the lattice of three-valued logical structures for fixpoint computation. The fact that the approach is based on logic makes bridging the gap between the program annotations and the analysis repr... |

368 | Alloy: A Lightweight Object Modelling Notation
- Jackson
(Show Context)
Citation Context ...sents a state of the program. The use of structures for representing program state has proven useful in the shape analysis [49], Abstract State Machines [7], the Alloy modelling language and analyzer =-=[27]-=-, and relational databases [13, 15]. Three-Valued Structures A three-valued structure is a model for Kleene's three-valued logic [32, 44] and di#ers from two-valued structure by the fact that predicat... |

350 | Checking system rules using system-specific, programmer-written compiler extensions
- Engler, Chelf, et al.
- 2000
(Show Context)
Citation Context ...hat the entailment and the equivalence are decidable as well. Researchers have proposed several program checking techniques based on dataflow analysis, symbolic execution, and abstract interpretation =-=[6, 9, 12, 18, 19, 24, 40]-=-. The primary strength of the shape analysis approach compared to the alternative approaches is the ability to perform sound and precise reasoning about dynamically allocated data structures. The bool... |

299 | Solving shape-analysis problems in languages with destructive updating
- Sagiv, Reps, et al.
- 1998
(Show Context)
Citation Context ...ed structure 〈U, ι〉 maps a binary relation symbol r to a three-valued relation ι(r) : U × U → {{0}, {1}, {0, 1}}. Three-valued structures generalize the graphs used in several previous shape analyses =-=[44, 22, 9]-=-. The elements of the domain U of a three-valued structure 〈U, ι〉 represent disjoint non-empty sets of objects. Given two such sets A and B, we can compute the three-valued relation by ι(r)(A, B) = {ι... |

280 |
A static analyzer for finding dynamic programming errors
- BUSH, PINCUS, et al.
- 2000
(Show Context)
Citation Context ...hat the entailment and the equivalence are decidable as well. Researchers have proposed several program checking techniques based on dataflow analysis, symbolic execution, and abstract interpretation =-=[6, 9, 12, 18, 19, 24, 40]-=-. The primary strength of the shape analysis approach compared to the alternative approaches is the ability to perform sound and precise reasoning about dynamically allocated data structures. The bool... |

277 | Local reasoning about programs that alter data structures - O’Hearn, Reynolds, et al. - 2001 |

238 | Interprocedural May-Alias analysis for pointers: Beyond k-limiting
- Deutsch
- 1994
(Show Context)
Citation Context ... logic analyzer is in [38], an extension to interprocedural analysis is in [47] and the use of shape analysis for program verification is demonstrated in [39]. Other shape analysis techniques include =-=[16, 20, 21, 25, 33, 37, 43]-=-. Our paper presents a contribution to the characterization of heap summaries by formulas, which is a promising direction of shape analysis that has been initiated in [34,35,46,52]. Shape analysis con... |

195 | A static analyzer for large safety-critical software
- Blanchet, Cousot, et al.
- 2003
(Show Context)
Citation Context ...hat the entailment and the equivalence are decidable as well. Researchers have proposed several program checking techniques based on dataflow analysis, symbolic execution, and abstract interpretation =-=[6, 9, 12, 18, 19, 24, 40]-=-. The primary strength of the shape analysis approach compared to the alternative approaches is the ability to perform sound and precise reasoning about dynamically allocated data structures. The bool... |

178 |
Raymie Stata. Extended static checking for Java
- Flanagan, Leino, et al.
- 2002
(Show Context)
Citation Context |

176 | Alias types - Smith, Walker, et al. - 2000 |

165 |
as an assertion language for mutable data structures
- BI
- 2001
(Show Context)
Citation Context ...33, 37, 43, 49]. An alternative approach is to identify each heap object using the set of paths that lead to the object [8, 16, 23]. Other notations for reasoning about the heap include spatial logic =-=[10, 11, 26, 45]-=- and alias types [50, 51]. It is possible to apply predicate abstraction techniques [2, 3, 22] to perform shape analysis; the view of three-valued structures as boolean combinations of constraints of ... |

160 |
Detecting conflicts between structure accesses
- Larus, Hilfinger
- 1988
(Show Context)
Citation Context ... logic analyzer is in [38], an extension to interprocedural analysis is in [47] and the use of shape analysis for program verification is demonstrated in [39]. Other shape analysis techniques include =-=[16, 20, 21, 25, 33, 37, 43]-=-. Our paper presents a contribution to the characterization of heap summaries by formulas, which is a promising direction of shape analysis that has been initiated in [34,35,46,52]. Shape analysis con... |

150 | The pointer assertion logic engine
- Møller, Schwartzbach
- 2000
(Show Context)
Citation Context ...ts to the satisfiability problem. Keywords: Shape Analysis, Program Verification, Abstract Interpretation, Boolean Algebra, First-Order Logic, Model Checking 1 Introduction Background. Shape analysis =-=[46,32,22,20,12,16,15,9,37,27]-=- is a technique for statically analyzing programs that manipulate dynamically allocated data structures, and is important for precise reasoning about programs written in modern imperative programming ... |

139 | Alias types for recursive data structures - Walker, Morrisett |

125 | Graph Types - Klarlund, Schwartzbach - 1993 |

106 | A flexible approach to interprocedural data flow analysis and programs with recursive data structures
- Jones, Muchnick
- 1982
(Show Context)
Citation Context ...ts to the satisfiability problem. Keywords: Shape Analysis, Program Verification, Abstract Interpretation, Boolean Algebra, First-Order Logic, Model Checking 1 Introduction Background. Shape analysis =-=[46,32,22,20,12,16,15,9,37,27]-=- is a technique for statically analyzing programs that manipulate dynamically allocated data structures, and is important for precise reasoning about programs written in modern imperative programming ... |

100 | Role analysis
- Kuncak, Lam, et al.
- 2002
(Show Context)
Citation Context ... logic analyzer is in [38], an extension to interprocedural analysis is in [47] and the use of shape analysis for program verification is demonstrated in [39]. Other shape analysis techniques include =-=[16, 20, 21, 25, 33, 37, 43]-=-. Our paper presents a contribution to the characterization of heap summaries by formulas, which is a promising direction of shape analysis that has been initiated in [34,35,46,52]. Shape analysis con... |

81 | Putting static analysis to work for verification: A case study
- Lev-Ami, Reps, et al.
- 2000
(Show Context)
Citation Context ...s given in [44]. A description of three-valued logic analyzer is in [38], an extension to interprocedural analysis is in [47] and the use of shape analysis for program verification is demonstrated in =-=[39]-=-. Other shape analysis techniques include [16, 20, 21, 25, 33, 37, 43]. Our paper presents a contribution to the characterization of heap summaries by formulas, which is a promising direction of shape... |

75 | Shape types
- Fradet, Métayer
- 1997
(Show Context)
Citation Context ...se writing applications in this programming model is error-prone, tools for statically verifying partial correctness of such programs are very valuable. Shape Analysis Shape analysis techniques [49], =-=[20, 21, 43]-=- can verify and derive precise properties of objects in the heap. Shape analysis therefore appears essential for reasoning about programs written in modern imperative programming languages. Shape anal... |

73 | A general data dependence test for dynamic, pointer-based data structures
- Hummel, Hendren, et al.
- 1994
(Show Context)
Citation Context |

71 | MONA implementation secrets - Klarlund, Møller, et al. - 2001 |

61 | Relative completeness of abstraction refinement for software model checking
- Ball, Podelski, et al.
- 2002
(Show Context)
Citation Context ... lead to the object [8, 16, 23]. Other notations for reasoning about the heap include spatial logic [10, 11, 26, 45] and alias types [50, 51]. It is possible to apply predicate abstraction techniques =-=[2, 3, 22]-=- to perform shape analysis; the view of three-valued structures as boolean combinations of constraints of certain form may be beneficial for this direction of work and enable easier application of rep... |

59 | Automatic Verification of Pointer Programs Using Monadic Second-order Logic - Jensen, Jørgensen, et al. |

55 | A Logic for Abstract State Machines
- Stark, Nanchen
(Show Context)
Citation Context ...ogram analysis, each two-valued structure represents a state of the program. The use of structures for representing program state has proven useful in the shape analysis [49], Abstract State Machines =-=[7]-=-, the Alloy modelling language and analyzer [27], and relational databases [13, 15]. Three-Valued Structures A three-valued structure is a model for Kleene's three-valued logic [32, 44] and di#ers fro... |

52 | Deciding Validity in a Spatial Logic for Trees
- Calcagno, Cardelli, et al.
- 2005
(Show Context)
Citation Context ...33, 37, 43, 49]. An alternative approach is to identify each heap object using the set of paths that lead to the object [8, 16, 23]. Other notations for reasoning about the heap include spatial logic =-=[10, 11, 26, 45]-=- and alias types [50, 51]. It is possible to apply predicate abstraction techniques [2, 3, 22] to perform shape analysis; the view of three-valued structures as boolean combinations of constraints of ... |

44 |
and Navindra Umanee. Points-to analysis using bdds
- Berndl, Lhoták, et al.
- 2003
(Show Context)
Citation Context ...es. Moreover, the characterization of existing shape analysis constraints as disjunctive normal forms of formulas suggests that alternative representations for three-valued structures may be possible =-=[5, 41, 42]-=-. The characterization of three-valued structures by formulas allows us to easily prove properties that are less obvious in the three-valued structure view, such as closure of three-valued structures ... |

39 | Is it a tree, a DAG or a cyclic graph
- Ghiya, Hendren
- 1996
(Show Context)
Citation Context ...se writing applications in this programming model is error-prone, tools for statically verifying partial correctness of such programs are very valuable. Shape Analysis Shape analysis techniques [49], =-=[20, 21, 43]-=- can verify and derive precise properties of objects in the heap. Shape analysis therefore appears essential for reasoning about programs written in modern imperative programming languages. Shape anal... |

35 | Static Source Code Checking for User-Defined Properties
- Holzmann
- 2002
(Show Context)
Citation Context |

31 | Shape analysis through predicate abstraction and model checking
- Dams, Namjoshi
- 2003
(Show Context)
Citation Context ...ed structures as boolean combinations of constraints of certain form may be beneficial for this direction of work and enable the easier application of representations such as binary decision diagrams =-=[11, 5, 36]-=-. The boolean algebra of state predicates and predicate transformers has been used successfully as the foundation of refinement calculus [1]. In this paper we have identified a particular subalgebra o... |

30 | Logical characterizations of heap abstractions
- Yorsh
- 2003
(Show Context)
Citation Context ...k of Sagiv, Reps, and Wilhelm [45,46] uses three-valued structures as dataflow lattice elements to represent sets of states at different program points. The recent work of Yorsh, Reps, Sagiv, Wilhelm =-=[48, 50]-=- introduces a family of formulas in (classical, two-valued) logic that are isomorphic to three-valued structures [46] and represent the same sets of concrete states. In this paper we introduce a large... |

27 | Graphs and decidable transductions based on edge constraints - Klarlund, Schwartzbach - 1994 |

25 | Compile-time debugging of C programs working on trees
- Elgaard, Møller, et al.
- 2000
(Show Context)
Citation Context ... other examples of decidable constraints can be formulated based on the techniques of logic Lr of [4] or based on monadic second-order logic of trees which is in the heart of the graph types approach =-=[17, 28--31, 43]-=-. 7 Related Work A parametric framework for shape analysis is presented in [49]. A systematic presentation of three-valued logic with equality is given in [44]. A description of three-valued logic ana... |

24 |
Symbolic evaluation methods for program analysis
- Clarke, Richardson
- 1981
(Show Context)
Citation Context |

23 | A trace model for pointers and objects
- Hoare, He
- 1999
(Show Context)
Citation Context ...aches which view program as transforming concrete graph structures [20, 21, 25, 33, 37, 43, 49]. An alternative approach is to identify each heap object using the set of paths that lead to the object =-=[8, 16, 23]-=-. Other notations for reasoning about the heap include spatial logic [10, 11, 26, 45] and alias types [50, 51]. It is possible to apply predicate abstraction techniques [2, 3, 22] to perform shape ana... |

17 | Semantic analysis of pointer aliasing, allocation and disposal in Hoare logic
- Calcagno, Ishtiaq, et al.
- 2000
(Show Context)
Citation Context ...33, 37, 43, 49]. An alternative approach is to identify each heap object using the set of paths that lead to the object [8, 16, 23]. Other notations for reasoning about the heap include spatial logic =-=[10, 11, 26, 45]-=- and alias types [50, 51]. It is possible to apply predicate abstraction techniques [2, 3, 22] to perform shape analysis; the view of three-valued structures as boolean combinations of constraints of ... |

16 |
Rinetzky and Mooly Sagiv. Interprocedural shape analysis for recursive programs
- Noam
(Show Context)
Citation Context ...45, 46]. A systematic presentation of three-valued logic with equality is given in [38]. A description of a three-valued logic analyzer TVLA is in [33], an extension to interprocedural analysis is in =-=[43,42]-=-, and the use of shape analysis for program verification is demonstrated in [34]. A finite differencing approach for automatically computing transfer functions for analysis is presented in [39]. A sha... |

15 | Class-level modular analysis for object oriented languages
- Logozzo
- 2003
(Show Context)
Citation Context |

14 | Existential heap abstraction entailment is undecidable
- Kuncak, Rinard
(Show Context)
Citation Context ...both the implication and the equivalence of shape analysis constraints are reducible to the satisfiability of shape analysis constraints. This result is in contrast to "regular graph constraints =-=" of [35]-=-, which have a decidable satisfiability problem but undecidable implication and the equivalence problems. The entailment problem is also important for compositional analysis which uses assume/guarante... |

14 |
Fradet and Daniel Le Métayer. Shape types
- Pascal
- 1997
(Show Context)
Citation Context |

14 |
The Pointer Assertion Logic Engine
- Mller, Schwartzbach
- 2001
(Show Context)
Citation Context ...ts to the satisfiability problem. Keywords: Shape Analysis, Program Verification, Abstract Interpretation, Boolean Algebra, First-Order Logic, Model Checking 1 Introduction Background. Shape analysis =-=[9, 12,15,16,20,22,27,32,37,46]-=- is a technique for statically analyzing programs that manipulate dynamically allocated data structures, and is important for precise reasoning about programs written in modern imperative programming ... |

14 | T.: Algorithms and Data - Meinel, Theobald - 1998 |

13 | On role logic
- Kuncak, Rinard
- 2003
(Show Context)
Citation Context ... as the results of [40,49,50,48], are decidable logics that can express heap properties. Among the promising such logics are monadic second-order logic of trees [23], the logic Lr [4], and role logic =-=[30]-=-. It is possible to apply predicate abstraction techniques [3, 2, 17] to perform shape analysis; the view of three-valued structures as boolean combinations of constraints of certain form may be benef... |

13 |
Shmuel Sagiv, and Greta Yorsh. Symbolic implementation of the best transformer
- Reps
- 2004
(Show Context)
Citation Context ...of value of F in S ♯ , and γ ∗ F (F ) = {S♯ ∈ 2-STRUCT | [F ] S♯ 1 An alternative approach proposes the use of theorem provers to synthesize threevalued structures from arbitrary first-order formulas =-=[49, 49, 40, 41]-=-, [48, Chapter 6]. 4smodels of F . If C is a set of formulas, then models[C] = {γ∗ F (F ) | F ∈ C} is the set of sets of models of formulas from C. Let A1 ⊆ A be a finite subset of unary predicates. W... |