## Underapproximating predicate transformers (2006)

Venue: | In Proc. SAS’06, LNCS |

Citations: | 9 - 4 self |

### BibTeX

@INPROCEEDINGS{Schmidt06underapproximatingpredicate,

author = {David A. Schmidt},

title = {Underapproximating predicate transformers},

booktitle = {In Proc. SAS’06, LNCS},

year = {2006},

pages = {127--143},

publisher = {Springer}

}

### OpenURL

### Abstract

Abstract. We study the underapproximation of the predicate transformers used to give semantics to the modalities in dynamic and temporal logic. Because predicate transformers operate on state sets, we define appropriate powerdomains for sound approximation. We study four such domains — two are based on “set inclusion ” approximation, and two are based on “quantification ” approximation — and we apply the domains to synthesize the most precise, underapproximating �pre and pre transformers, in the latter case, introducing a focus operation. We also show why the expected abstractions of post and �post are unsound, and we use the powerdomains to guide us to correct, sound underapproximations. 1

### Citations

1880 |
Abstract Interpretation: A Unified Lattice Model for Static Analysis of Programs by Construction or Approximation of Fixpoints
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...e downclosed (e.g., when g(⊥A) = ∅, where γ(⊥A) = ∅). When T = ∅, pre g(T ) = ∅, which is upclosed. ✷ 6 For example, div2 ♯ best (even) =↓{even, odd}, hence even ∈ pre div2 ♯ best 6 ∈ γ(even) and div2=-=(6)-=- = {3}. ↓{even}, yetsThe result goes against our intuition that propositions are interpreted as downclosed subsets of A. To make pre g(T ) into a downclosed set, it is necessary that a ⊑A a ′ implies ... |

631 | Systematic Design of Program Analysis Frameworks
- Cousot, Cousot
- 1979
(Show Context)
Citation Context ...ig. 1. Collatz program and its state-transition graph overapproximating f ♯ , �pre f ♯ [φ ] A underapproximates �pre f [φ ], meaning we can soundly calculate abstract preconditions like those in ACTL =-=[3, 7]-=-. But pre f ♯ is not well behaved for f ♯ , and the situations for post and �post are even less clear. This paper’s primary contribution is its systematic study of the powerdomains and Galois connecti... |

623 | Model Checking and Abstraction
- Clarke, Grumberg, et al.
- 1994
(Show Context)
Citation Context ...n f ♯ (any) = any Fig. 2. Parity abstraction of natural numbers and the Collatz function If a program’s state space is “too large,” we might abstract it. The abstraction might be a state partitioning =-=[2, 25]-=-, but more generally it is a complete lattice, (A, ⊑), such that there is a Galois connection of the form (P(C), ⊆)〈α, γ〉(A, ⊑): 1 Figure 2 abstracts the concrete domain Nat in Figure 1 to the complet... |

538 | Parametric shape analysis via 3-valued logic
- Sagiv, Reps, et al.
(Show Context)
Citation Context ...erlying issue is the well-known incompleteness of disjunction in approximation [8]; here, any �∈ T 0, even though γ(any) ⊆ γ(T 0). The standard repair is a focus operation, as used in the TVLA system =-=[28]-=-, and in disjunctive transition systems [11, 14, 20], and in tree automata [12], to “split” values like any into more-precise cases that “cover” all of γ(any). For the example, T 1 = {even, odd} is a ... |

247 | Abstract interpretation of reactive systems: abstractions preserving ∀CTL
- DAMS, GRUMBERG, et al.
- 1994
(Show Context)
Citation Context ...nd also that best Proposition 4. pre f ♭ best is sound: pre f ♭ (T ) ⊆ (αu ◦ pre f ◦ γ)(T ). best Figure 7 shows the abstracted precondition logic. Cleaveland, Iyer, and Yankelevich [4], Dams, et al. =-=[10]-=-, and Schmidt [30] showed that pre f ♭ proves the most best sound 〈f〉-properties in the logic of Figure 4.sset inclusion quantification overapproximation underapproximation P(C)〈αo, γ〉P↓(A) where γ(T ... |

192 | Abstract interpretation
- Cousot
- 1996
(Show Context)
Citation Context ...propose �pre f ♯ as a sound underapproximation — since f ♯ : A → P↓(A) overapproximates f’s transitions, f ♯ ’s preimages will correspond to supersets of f’s preimages. This gives the standard result =-=[8]-=-:sProposition 1. If f ♯ : A → P↓(A) is overapproximating sound (that is, α ◦ f ⊑ P(C)→A f ♯ ◦ α), then �pre f ♯ is underapproximating sound: αu( �pre f (S)) ⊇ �pre f ♯(αu(S)). We also have this pleasi... |

137 | Property preserving abstractions for the verification of concurrent systems
- Loiseaux, Graf, et al.
- 1995
(Show Context)
Citation Context ...ely — are used in practice. 11 In contrast, both post f ♯ and �post f ♭ are well defined overapproximations of the two postcondition transformers! .sThat is, f −1 (c) = {d | c ∈ f(d)}. Proposition 9. =-=[21]-=-: (f −1 ) −1 = f, post f = pre f −1, and �post f = �pre f −1. Proposition 10. For f : A → Pδ(A), δ ∈ {↓, ↑}, f −1 : A → P˜ δ (A) is well defined and monotonic. Proof. f −1 (a) = {a ′ | a ∈ f(a ′ )}. W... |

100 |
Abstract Interpretation and Partition Refinement for Model
- Dams
(Show Context)
Citation Context ...T , we are finished. ✷ Function f ♯ best : A → P↓(A) has been intensively studied: f ♯ best (a) = (αo ◦ f ∗ ◦ γ)(a) = ↓{α{c ′ } | c ∈ γ(a), c ′ ∈ f(c)}. Cleaveland, Iyer, and Yankelevich [4] and Dams =-=[9]-=- showed that f ♯ most [f]-properties in the logic in Figure 4. 3.2 Abstracting pre f Recall that pre f (S) = {c | f(c) ∩ S �= ∅}. The concrete semantics, [〈f〉φ ] = pre f [φ ] best proves the defines t... |

93 |
Abstract debugging of higher-order imperative languages
- Bourdoncle
- 1993
(Show Context)
Citation Context ...bstraction of predicate transformers begin in Cousot’s thesis [5]; details were spelled out in a subsequent series of papers by Cousot and Cousot [6–8] and applied by Bourdoncle to abstract debugging =-=[1]-=-, which was generalized by Massé [22, 23]. Loiseaux, et al. [21] formalized underapproximation of �pre . Cleaveland, Iyer, and Yankelevich [4], Dams [9], and Dams’s colleagues [10] were the first to s... |

93 |
Making abstract interpretations complete
- Giacobazzi, Ranzato, et al.
(Show Context)
Citation Context ...connection, P(C) op 〈αu, γ〉P↓(A) op : 5 where γ(T ) = ∪a∈Aγ(a), 4 Giacobazzi, Ranzato, and their colleages have intensively studied this problem, which is connected to the backwards completeness of f =-=[15, 17, 25, 26]-=-. 5 where (P, ⊑P ) op is (P, ⊒P )sas before, and αu(S) = ∪{T | S ⊇ γ(T )} = {a | γ(a) ⊆ S}. This is an underapproximating Galois connection, because S ⊇ γ(αu(S)). We can use it to define this most pre... |

90 |
Méthodes itératives de construction et d’approximation de points fixes d’opérateurs monotones sur un treillis, analyse sémantique des programmes. Université Scientifique et Médicale de Grenoble
- Cousot
- 1978
(Show Context)
Citation Context ...itions as preconditions of inverted statetransition relations is implemented in Steffen’s fixpoint analysis machine [35].s5 Related Work Abstraction of predicate transformers begin in Cousot’s thesis =-=[5]-=-; details were spelled out in a subsequent series of papers by Cousot and Cousot [6–8] and applied by Bourdoncle to abstract debugging [1], which was generalized by Massé [22, 23]. Loiseaux, et al. [2... |

85 |
Data-flow analysis is model checking of abstract interpretations
- Schmidt
- 1998
(Show Context)
Citation Context ... p ′ VBE(p ′ )) p ′ ∈pred p ((RD(p′ ) ∩ notModified(p ′ )) ∪ Defined(p ′ )) isReaching(d) = µZ. 〈p〉((Z ∧ ¬isModified(d)) ∨ isDefined(d)) Fig. 9. Data-flow analyses and their encodings in logical form =-=[29]-=- α ◦ succ∗ ◦ γ is the strongest postcondition transformer for Galois connection, P(Nat)〈α, γ〉Parity. Similarly, from f : C → P(C) and P(C)〈αo, γ〉P↓(A), we define f ♯ best : A → P↓(A) as f ♯ best = αo ... |

53 | Incompleteness, counterexamples and refinements in abstract model-checking
- Giacobazzi, Quintarelli
- 2001
(Show Context)
Citation Context ...connection, P(C) op 〈αu, γ〉P↓(A) op : 5 where γ(T ) = ∪a∈Aγ(a), 4 Giacobazzi, Ranzato, and their colleages have intensively studied this problem, which is connected to the backwards completeness of f =-=[15, 17, 25, 26]-=-. 5 where (P, ⊑P ) op is (P, ⊒P )sas before, and αu(S) = ∪{T | S ⊇ γ(T )} = {a | γ(a) ⊆ S}. This is an underapproximating Galois connection, because S ⊇ γ(αu(S)). We can use it to define this most pre... |

48 |
L.: Equation solving using modal transition systems
- Larsen, Xinxin
- 1990
(Show Context)
Citation Context ...ss of disjunction in approximation [8]; here, any �∈ T 0, even though γ(any) ⊆ γ(T 0). The standard repair is a focus operation, as used in the TVLA system [28], and in disjunctive transition systems =-=[11, 14, 20]-=-, and in tree automata [12], to “split” values like any into more-precise cases that “cover” all of γ(any). For the example, T 1 = {even, odd} is a focus set that covers any because γ(any) ⊆ γ(T 1). S... |

40 | Optimality in abstractions of model checking
- Cleaveland, Iyer, et al.
- 1995
(Show Context)
Citation Context ... αo(γ(T )) ⊆ T , we are finished. ✷ Function f ♯ best : A → P↓(A) has been intensively studied: f ♯ best (a) = (αo ◦ f ∗ ◦ γ)(a) = ↓{α{c ′ } | c ∈ γ(a), c ′ ∈ f(c)}. Cleaveland, Iyer, and Yankelevich =-=[4]-=- and Dams [9] showed that f ♯ most [f]-properties in the logic in Figure 4. 3.2 Abstracting pre f Recall that pre f (S) = {c | f(c) ∩ S �= ∅}. The concrete semantics, [〈f〉φ ] = pre f [φ ] best proves ... |

36 |
Proof systems for Hennessy-Milner logic with recursion
- Larsen
- 1988
(Show Context)
Citation Context ... 8. Steffen [34] showed how to use the [f]- and 〈f〉-modalities to define forwards data-flow analyses, and Schmidt [29] applied Steffen’s ideas, as displayed in Figure 9, to write mu-calculus formulas =-=[19]-=- that define the naive but standard forwards and backwards data-flow analyses on annotated control-flow graphs, where p ∈ ProgramPoint. For the purposes of program validation and code improvement, the... |

35 |
Introduction to Lattices and
- Davey, Priestley
- 2002
(Show Context)
Citation Context ...of A, which is 1 A Galois connection between two complete lattices, P and Q, written P 〈α, γ〉Q, is a pair of monontonic functions, α : P → Q and γ : Q → P , such that idP →P ⊑ γ ◦ α and α ◦ γ ⊑ idQ→Q =-=[7, 13]-=-. Note that γ’s inverse, α, is uniquely defined as α(p) = ⊓{q | p ⊑P γ(q)} and α’s inverse is γ(q) = ⊔{p | α(p) ⊑Q q}. 2 that is, for every T ⊆ A, ∩a∈T γ(a) = γ(⊓T ), which is necessary and sufficient... |

26 |
The existence of finite abstractions for branching time model checking
- DAMS, NAMJOSHI
(Show Context)
Citation Context ...ss of disjunction in approximation [8]; here, any �∈ T 0, even though γ(any) ⊆ γ(T 0). The standard repair is a focus operation, as used in the TVLA system [28], and in disjunctive transition systems =-=[11, 14, 20]-=-, and in tree automata [12], to “split” values like any into more-precise cases that “cover” all of γ(any). For the example, T 1 = {even, odd} is a focus set that covers any because γ(any) ⊆ γ(T 1). S... |

23 | Power domain constructions
- Heckmann
- 1991
(Show Context)
Citation Context ...When the property is abstracted to φ ♭ , which is itself a set, [φ ] A ∈ P(A), A’s ordering affects P(A)’s, and denotational semantics indicates there are a variety of powerdomains that one might use =-=[18, 24]-=- to establish soundness, i.e., [φ ] ⊇ γ ∗ [φ ] A . The situation becomes more complex when program P ’s concrete transition function is nondeterministic, f : C → P(C), meaning its abstraction should b... |

22 | Strong preservation as completeness in abstract interpretation
- Ranzato, Tapparo
- 2004
(Show Context)
Citation Context ...titions, computing least- and greatest fixed points of state-transition functions and recursively defined assertions requires a powerset of the state partitions, partially ordered by subset inclusion =-=[25]-=-. Next, a logical property, φ, is interpreted as a set, [φ ] ∈ P(C). When the property is abstracted to φ ♭ , which is itself a set, [φ ] A ∈ P(A), A’s ordering affects P(A)’s, and denotational semant... |

18 |
K.S.: Automata as Abstractions
- Dams, Namjoshi
(Show Context)
Citation Context ...[8]; here, any �∈ T 0, even though γ(any) ⊆ γ(T 0). The standard repair is a focus operation, as used in the TVLA system [28], and in disjunctive transition systems [11, 14, 20], and in tree automata =-=[12]-=-, to “split” values like any into more-precise cases that “cover” all of γ(any). For the example, T 1 = {even, odd} is a focus set that covers any because γ(any) ⊆ γ(T 1). Since both even ∈ T 0 and od... |

17 | The reduced relative power operation on abstract domains
- Giacobazzi, Ranzato
- 1999
(Show Context)
Citation Context ..., none}); if γ fails to preserve joins, there can be a T that makes the first inclusion an equality and the second one proper, because there is some c ∈ γ(T ) that cannot be “isolated” by a focus set =-=[16]-=-. 4 Postconditions Earlier, we noted that f ∗ : P(C) → P(C), for f : C → P(C), defines f’s postcondition transformer and f ♯ : A → A is its sound overapproximation. For example, succ∗ {1, 3, 5, · · ·}... |

15 | An abstract interpretation-based refinement algorithm for strong preservation
- Ranzato, Tapparo
- 2005
(Show Context)
Citation Context ...connection, P(C) op 〈αu, γ〉P↓(A) op : 5 where γ(T ) = ∪a∈Aγ(a), 4 Giacobazzi, Ranzato, and their colleages have intensively studied this problem, which is connected to the backwards completeness of f =-=[15, 17, 25, 26]-=-. 5 where (P, ⊑P ) op is (P, ⊒P )sas before, and αu(S) = ∪{T | S ⊇ γ(T )} = {a | γ(a) ⊆ S}. This is an underapproximating Galois connection, because S ⊇ γ(αu(S)). We can use it to define this most pre... |

15 | The fixpointanalysis machine
- Steffen, Claßen, et al.
- 1995
(Show Context)
Citation Context ... → P↓(A) is (f −1 ) ♯ best = αo ◦ (f −1 ) ∗ ◦ γ. This approach of computing postconditions as preconditions of inverted statetransition relations is implemented in Steffen’s fixpoint analysis machine =-=[35]-=-.s5 Related Work Abstraction of predicate transformers begin in Cousot’s thesis [5]; details were spelled out in a subsequent series of papers by Cousot and Cousot [6–8] and applied by Bourdoncle to a... |

13 | Three-valued abstraction: More precision at less cost
- Shoham, Grumberg
- 1998
(Show Context)
Citation Context ...st = 9 Focus sets are also known as must hyper transitions [32], and there is a dual notion of may hyper transitions, which prove useful when γ : A → C is not the upper adjoint of a Galois connection =-=[33]-=-.s[a ] = γ(a) [[f]φ ] = �post f [φ ] [〈f〉φ ] = post f [φ ] Available Expressions: � [ · ] : L → P(C) [φ1 ∧ φ2 ] = [φ1 ] ∩ [φ2 ] [φ1 ∨ φ2 ] = [φ1 ] ∪ [φ2 ] Fig. 8. The postcondition logic AE(p) =gfp p ... |

12 |
Generating Data-Flow Analysis Algorithms for Modal Specifications
- Steffen
- 1993
(Show Context)
Citation Context ...one of d’s immediate f-predecessors belongs to S; d ∈ �post f (S) means that all of d’s immediate f-predecessors belong to S. These transformers have a natural place in a logic; see Figure 8. Steffen =-=[34]-=- showed how to use the [f]- and 〈f〉-modalities to define forwards data-flow analyses, and Schmidt [29] applied Steffen’s ideas, as displayed in Figure 9, to write mu-calculus formulas [19] that define... |

10 | Closed and logical relations for over- and under-approximation of powersets
- Schmidt
- 2004
(Show Context)
Citation Context ...use S ρ↓ T iff S ⊆ γ(T ), no new expressibility is gained by using the new Galois connection over P(C)〈αo, γ〉P↓(A): for all f : C → P(C), f ♯ : A → best P↓(A) is α↓ ◦ ({|· |}◦ f) ∗ ◦ γ = αo ◦ f ∗ ◦ γ =-=[30, 31]-=-. But we might argue nonetheless that this Galois connection “truly defines” the sound overapproximation of f. On the other hand, the existential interpretation is truly new; it uses the Smyth-powerdo... |

9 |
A calculus of logical relations for over- and underapproximating static analyses
- Schmidt
(Show Context)
Citation Context ...use S ρ↓ T iff S ⊆ γ(T ), no new expressibility is gained by using the new Galois connection over P(C)〈αo, γ〉P↓(A): for all f : C → P(C), f ♯ : A → best P↓(A) is α↓ ◦ ({|· |}◦ f) ∗ ◦ γ = αo ◦ f ∗ ◦ γ =-=[30, 31]-=-. But we might argue nonetheless that this Galois connection “truly defines” the sound overapproximation of f. On the other hand, the existential interpretation is truly new; it uses the Smyth-powerdo... |

4 | Strong preservation of temporal fixpoint-based operators by abstract interpretation - Ranzato, Tapparo - 2006 |

2 |
Complete abstraction through extensions of disjunctive modal transition systems
- Fecher, Huth
- 2006
(Show Context)
Citation Context ...ss of disjunction in approximation [8]; here, any �∈ T 0, even though γ(any) ⊆ γ(T 0). The standard repair is a focus operation, as used in the TVLA system [28], and in disjunctive transition systems =-=[11, 14, 20]-=-, and in tree automata [12], to “split” values like any into more-precise cases that “cover” all of γ(any). For the example, T 1 = {even, odd} is a focus set that covers any because γ(any) ⊆ γ(T 1). S... |

2 |
Combining backward and forward analyses of temporal properties
- Massé
- 2001
(Show Context)
Citation Context ... begin in Cousot’s thesis [5]; details were spelled out in a subsequent series of papers by Cousot and Cousot [6–8] and applied by Bourdoncle to abstract debugging [1], which was generalized by Massé =-=[22, 23]-=-. Loiseaux, et al. [21] formalized underapproximation of �pre . Cleaveland, Iyer, and Yankelevich [4], Dams [9], and Dams’s colleagues [10] were the first to study underapproximations of pre . Studies... |

1 |
Property checking driven abstract interpretation-based static analysis
- Massé
- 2003
(Show Context)
Citation Context ... begin in Cousot’s thesis [5]; details were spelled out in a subsequent series of papers by Cousot and Cousot [6–8] and applied by Bourdoncle to abstract debugging [1], which was generalized by Massé =-=[22, 23]-=-. Loiseaux, et al. [21] formalized underapproximation of �pre . Cleaveland, Iyer, and Yankelevich [4], Dams [9], and Dams’s colleagues [10] were the first to study underapproximations of pre . Studies... |

1 |
Monotonic abstraction refinement for CTL
- Shoham, Grumberg
- 2004
(Show Context)
Citation Context ...♯ : A → A is its sound overapproximation. For example, succ∗ {1, 3, 5, · · ·} = {2, 4, 6, · · ·} and succ ♯ best (odd) = even, where succ♯ best = 9 Focus sets are also known as must hyper transitions =-=[32]-=-, and there is a dual notion of may hyper transitions, which prove useful when γ : A → C is not the upper adjoint of a Galois connection [33].s[a ] = γ(a) [[f]φ ] = �post f [φ ] [〈f〉φ ] = post f [φ ] ... |