Interprocedural Analysis of Concurrent Programs Under a Context Bound

16 Pages·2007·0.32 MB·English

Interprocedural Analysis of Concurrent Programs Under a
Context Bound
AkashLal TayssirTouili NicholasKidd ThomasReps
UniversityofWisconsin LIAFA,CNRS&UniversityofParis7 UniversityofWisconsin
[email protected] [email protected] {kidd,reps}@cs.wisc.edu
Abstract Inpreviouswork,QadeerandRehof[36]showedthatCBAis
decidableforrecursiveprogramsunderafinite-stateabstractionof
Analysisofrecursiveprogramsinthepresenceofconcurrencyand
program data. Inthispaper, we generalize their result to infinite-
sharedmemoryisundecidable.Acommonapproachistoremove
stateabstractions, andalsoprovideanewsymbolicalgorithmfor
therecursivenatureoftheprogramwhiledealingwithconcurrency.
thefinitecase.
Adifferentapproach istobound thenumber ofcontext switches,
Our goal is to be able to take any abstraction used for inter-
which has been shown to be very useful for program analysis.
procedural analysis of sequential programs and directly extend it
In previous work, Qadeer and Rehof [36] showed that context-
to handle context-bounded concurrency. Our main result follows
boundedanalysisisdecidableforrecursiveprogramsunderafinite-
inthespirit ofcoincidence theorems indataflow analysis (forse-
stateabstractionofprogramdata.Inthispaper,wegeneralizetheir
quentialprograms)[20,22,43].Wegiveconditionsontheabstrac-
resulttoinfinite-stateabstractions,andalsoprovideanewsymbolic
tionsunderwhichCBAcanbepreciselysolved,alongwithanal-
algorithmforthefinitecase.
gorithm. In addition to the usual conditions required for precise
interproceduralanalysis,werequiretheexistenceofatensorprod-
uct(definedin§6).Weshowthattheseconditionsaresatisfiedbya
1. Introduction classofabstractions,thusgivingprecisealgorithmsforCBAwith
thoseabstractions. Theseincludefinite-stateabstractions, suchas
In this paper, we consider analysis of concurrent programs with
theonesusedforverificationofBooleanprogramsinmodelcheck-
shared-memoryandinterleavingsemantics.Analysisofsuchpro-
ing[3],aswellasinfinite-stateabstractions,suchasaffine-relation
grams is generally considered hard because of the large number
analysis(ARA)[29].Notethatwithoutacontextbound,reasoning
ofinterleavingstheanalysishastoconsider.Especiallyhardisthe
aboutconcurrentprogramsundertheseabstractionsisundecidable
analysis of recursive programs, because their control state space
[28,38].
is infinite. In fact, the analysis of recursive programs, even with
ForapreciseCBA,oneneedstostartoffwithapreciseinter-
afinite-stateabstractionofdata(suchasinBooleanprograms),is
proceduralanalysis.Weightedpushdownsystems(WPDSs)[25,40]
undecidableinthepresenceofconcurrencyandsharedmemory.
areageneral model for interprocedural analysis. Theyarea gen-
Ananalysisforrecursiveprogramshastoaccuratelymodelthe
eralization of pushdown systems (PDSs).PDSscan model recur-
procedure call and return semantics, i.e., it should only consider
sive programs [42], and WPDSs add a general “black-box” ab-
program executions in which a procedure return is matched with
stractionforprogramdata(throughweights)toPDSs.WPDSsalso
the most recent call. Such interprocedural analyses have proven
generalize other frameworks for interprocedural analysis such as
tobeveryusefulforsequentialprograms[3,39–41].Considering
theSharir-Pnuelifunctionalapproach[43]andtheReps-Horwitz-
thedesirabilityofinterproceduralanalysis,itsundecidabilityinthe
Sagivsummary-basedapproach[41].WeshowthatwhenaWPDS
presenceofconcurrencyisunfortunate.Asaconsequence,todeal
is used to model each thread of a concurrent program, CBA can
withconcurrencysoundly,mostanalysesgiveupprecisehandling
bepreciselycarriedoutfortheprogram,providedtensorproducts
ofproceduresandbecomecontext-insensitive.Alternatively,tools
existfortheweights.
can use inlining to unfold multi-procedure programs into single-
procedureones.Thisapproachcannothandlerecursiveprograms,
1.1 Motivation
andcancauseanexponentialblowupinthesizefornon-recursive
ones. Context-boundedanalysisisnotsoundbecauseitdoesnotcapture
Adifferent waytosidesteptheundecidability issueistolimit allofthebehaviors ofaprogram. However, ithasbeenshownto
the amount of concurrency by bounding the number of context beveryusefulforprogramanalysis.KISS,averificationtoolthat
switches,whereacontextswitchisdefinedasthetransferofcontrol analyzesprogramsforuptotwocontextswitches,wasabletofinda
fromone thread toanother. Such anabstraction has proven tobe numberofbugsindrivers[37].Anotherstudy,usingexplicit-state
veryusefulforprogramanalysisbecausemanybugscanbefound model checking, alsoconfirms that many bugs can be found ina
in a few context switches [32, 36, 37]. We call an analysis of a fewcontextswitches[32].Moreover,itshowsstate-spacecoverage
recursiveandconcurrentprogramunderacontextbound,acontext- graphsthat indicatethatmanyprogram behaviorsarecapturedin
boundedanalysis(CBA). the first few context switches, with fewer behaviors being added
CBA does not impose any bound on the execution length be- withadditional context switches. Our goal istodevelop analyses
tweencontextswitches.Thus,evenunderacontextbound,theanal- thataresoundunderacontextbound.
ysisstillhastoconsider thepossibilitythat thenext switchtakes PreviousworkhasonlyconsideredCBAforarestrictedsetof
placeinanyoneofthe(possiblyinfinite)statesthatmaybereached abstractions.HavingtheabilitytodoCBAwithotherabstractions
afteracontext switch.Because ofthis,CBAstillconsiders many canbeveryusefulforanalyzingconcurrentprograms.Forexample,
concurrentbehaviors[32]. considertheprogramsnippetinFig.1.Here,multiplethreadsshare
thecircularbufferqinaproducer (enq)consumer (deq)fashion. ingthreadinterleavingsredundant,asweshallseelater).Forpro-
Using CBA with ARA with modular arithmetic, one can prove gramanalysis,weonlyhaveweakerpropertiesonweights.Tocom-
(underagivencontextbound)that(hd - tl - cnt) % SIZE = poseweightedtransducers,werequirethatweightdomainsprovide
0providedSIZEisaprimepower[30].ARAgeneralizesanalyses a tensor-product operation (§6). Tensor products have been used
like copy-constant propagation, linear-constant propagation, and previously in program analysis for combining abstractions [33].
induction-variableanalysis.Itcanbeusedtofindinvariants,such However,weusetheminadifferentcontextandforacompletely
astheoneshownabove,toincreasetheprecisionofotheranalysis. different purpose. In particular, previous work has used them for
combining abstractions that are to be performed in lock-step; in
Elemq[SIZE]; voidenq(Eleme) { Elemdeq() { contrast,weusethemtostitchtogetherthedatastatebeforeacon-
inthd= cnt= tl= 0; while(true) { while(true) { textswitchwiththedatastateafteracontextswitch.Thisisnon-
atomic { atomic { trivialbecausethedatastateiscorrelatedwithan(unbounded)pro-
if( cnt< SIZE) { if(cnt> 0) { gramstack.
q[tl] = e; Eleme = q[hd]; By using WPDSs, not only do we obtain new algorithms for
infinite-stateabstractions,but alsosymbolic algorithmsfor finite-
tl= (tl+1)%SIZE; hd= (hd+1)%SIZE;
stateabstractions.Thelatteralgorithmsavoidtheenumerationthat
cnt++; cnt--;
theQRalgorithmperformsatacontextswitch.
break; return e;
Thecontributionsofthispapercanbesummarizedasfollows:
} }
}}} }}} • We give sufficient conditions under which CBA is decidable,
along with an algorithm. This generalizes previous work on
Figure1. Aconcurrentprogramthatmanagesacircularqueue. CBA of PDSs [36]. Our result also proves that CBA can be
decided for affine-relationanalysis, i.e.,wecan preciselyfind
Thecontextboundcanbeincreasediterativelytoconsidermore allaffinerelationshipsbetweenprogramvariablesthatholdat
effects of concurrency and to analyze more program behaviors. aparticularpointinthe(concurrent)program.WeuseWPDSs
Thishastheaddedadvantageoffindingbugsinthefewestcontext asour program model, and theweights encode theprogram’s
switchesneededtotriggerthem.Itisreasonabletoconsiderabug dataabstraction.ByusingWPDSs,wecanalsoanswer“stack-
that arises only after a greater number of context switches to be qualified”queries[40],whichaskforthesetofvaluesthatmay
“harder” than a bug that requires fewer context switches. Thus, ariseataprogrampointinagivencallingcontext,orinaregular
CBAallowsadditionalconcurrencytobeconsidered“on-demand”. setofcallingcontexts.
• WeshowthatforWPDSs,thereachabilityrelationcanbeen-
1.2 ChallengesandTechniques
codedusingaweightedtransducer (§5),generalizingprevious
Betweenconsecutivecontext switches,aconcurrent programacts resultforPDSsbyCaucal[10].Theuseofweightedtransducers
like a sequential program because only one thread is executing. (insteadofBu¨chi’sresult,oritsgeneralizationtoweightedsys-
However,arecursivethreadcanreachaninfinitenumberofstates tems[40])appearstobeanecessarystepforCBAwithinfinite-
beforethenextcontextswitchbecauseithasanunboundedstack. statedataabstractions.
ACBAhastoconsiderthepossibilityofacontextswitchoccurring
• Wegiveprecisealgorithmsforcomposingweightedtransduc-
atanyoneofthesestates.
ers(§6),whentensorproductsexistfortheweights.Thisgen-
The Qadeer-Rehof (QR) algorithm used (unweighted) PDSs
eralizespreviousworkonmanipulatingweightedautomataand
(which can encode recursive programs with a finite data abstrac-
transducers[26,27].Wealsoshowaclassofabstractionsthat
tion)toencodeprogramthreads.AninfluentialresultbyBu¨chi[9]
satisfiesthisproperty.
showedthatthesetofreachablestatesofaPDScanberepresented
usinganautomaton.TheQRalgorithmmakesuseofthisresultto • WediscussimplementationissuesforrealizingCBAin§7.We
getahandleonallreachablestatesbetweencontextswitches.How- showthatforPDSs,CBAisNP-complete.Ouralgorithm,based
ever,toexploreallpossiblecontextswitches,itcruciallyrelieson on transducers, does have a large complexity but it is more
thefinitenessofthedataabstractionbecauseitenumeratesoverall amenable tosymbolic techniques such asusing BDDs(inthe
reachabledatastatesatacontextswitch. finite-statecase)thantheQRalgorithm.
Ourfirststepistodevelopanewalgorithmforthecaseofun-
Therestofthepaperisorganizedasfollows.In§2,wediscuss
weightedPDSs.Ourmotivationistohaveanalgorithmthatismore
previousworkonCBAunderafinite-statedataabstraction.In§3,
likelytogeneralizetohandleotherabstractions.Thenewalgorithm
we present our algorithm based on transducers. In §4, we give
(§3)representstheeffectofexecutingathread(aPDS)fromanyar-
backgroundonWPDSs.In§5,wegiveanefficientconstructionfor
bitrarystateusingafinite-statetransducer.Thetransduceraccepts
transducersforWPDSs.In§6,weshowhowweightedtransducers
apair(c1,c2)ifathread,whenstartedinstatec1,canreachstate can be composed. In §7, we discuss implementation issues for
c2.Caucal[10]showedthatsuchtransducerscanbeconstructedfor CBA.In§8,wediscussrelatedwork.
PDSs,aresultmoregeneralthanthatofBu¨chi’s.Next,thesetrans-
ducersarecomposedtodescribethebehavioroftheentireprogram
2. ContextBoundedModelChecking
withmultiplethreads.Onetransducercompositionisperformedfor
eachcontextswitch. Inthissection,weconsiderCBAunderafinite-statedataabstrac-
WethengeneralizethisalgorithmforWPDSs(§5and§6).The tion, which we call context-bounded model checking or CBMC.
weights(orthedataabstraction)addseveralcomplications.Wede- Here,eachthreadofaconcurrentprogramismodeledusingaPDS.
fine weighted transducers to capture the reachability relation of FirstwedefineBooleanprograms,apopularprogramabstrac-
WPDSs.Weshow thataweightedtransducer canalwaysbecon- tionusedinmodelchecking[3].Theyserveasaprogram-modeling
structedforaWPDS(nosuchresultwasknownpreviously).The framework that provides finite data and unbounded control. We
next step is to compose these transducers. While weighted au- show how PDSs can encode them. We then formally define the
tomataand transducers havebeen considered inthe literaturebe- CBMCproblem,anddiscusstheQRalgorithm.
fore,theweightsareassumedtohavemuchstrongerproperties(es- Notation. A binary relation on a set S is a subset of S ×
peciallycommutativity,whichdefeatsthepurposeofCBAbymak- S. If R1 and R2 are binary relations on S, then their relational
composition(R1;R2)isdefinedas{(s1,s3)|∃s2 ∈S,(s1,s2)∈ Rule Controlflowmodeled
R1,(s2,s3) ∈ R2}.IfRisabinaryrelation,Ri istherelational hp,ui֒→hp,vi CFGedgeu→v,whichisnotacall
compositionofRwithitselfitimes,andR0istheidentityrelation hp,ci֒→hp,f ri CFGedgec→r,whichcalls
enter
onS.R∗ =∪∞i=0Riisthereflexive-transitiveclosureofR. proceduref beginningatnodefenter
hp,f i֒→hp,εi Returnfromproceduref atf
exit exit
2.1 BooleanPrograms
ABooleanprogramcanbethoughtofasaCprogramwithonlythe Figure2. TheencodingofcontrolflowasPDSrules.
Booleandatatype.Itdoesnothaveanypointersorheap-allocated
storage.ABooleanprogramconsistsofafinitesetofprocedures.It
hasafinitesetofglobalvariables,andafinitesetoflocalvariables fenter, is a set of rules hg,(c,l)i ֒→ hg,(fenter,l0) (r,l)i, for all
for each procedure. Each variable can only hold a value from a (g,l)∈G×Valiandl0 ∈Valf.
finitedomain.Weassumethatproceduresdonothaveparameters UndersuchanencodingofBooleanprogramsasPDSs,acon-
(theycanbepassedthroughtheglobalvariables).Thevariablesin figurationhp,γ1γ2···γniisanelementofG×Lthatdescribesthe
scopeinsideaprocedurearetheglobalvariablesanditssetoflocal instantaneousstateofaprogram.Thestatepencodesthevaluesof
variables. globalvariables;γ1 encodesthecurrentprogramlocationandthe
A procedure is described by its control-flow graph (CFG), valuesoflocalvariablesinscope;andtherestofthestackencodes
which has a designated entry and a designated exit node. Nodes thelistofunfinishedcallswiththevaluesoflocalvariablesatthe
of the graph are program control locations, and each edge is la- timethecallwasmade.ThePDStransitionrelation(⇒),whichis
beledwithastatement.Astatementcanbeanassignment,reading essentiallyatransitionrelationonG×L,representsthesemantics
fromandwritingtovariablesinscope;oranassumestatement(for oftheBooleanprogram.
conditions);oraprocedurecall.AnexampleisshowninFig.4(a). Theproblemofinterest,forsequentialprograms,istofindthe
LetGbethesetofglobalstatesoftheprogram, consistingof set of all reachable configurations, starting from a given set of
valuations of global variables. Let L be the set of local states of configurations. This can then be used, for example, for assertion
theprogram,consistingoftheprogramcounter,avaluationoflocal checking(i.e.,determiningifagivenassertioncaneverfail)orto
variables,andtheprogramstack(consistingofreturnaddressesand find the set of all data values that may arise at a program point
avaluationofthelocalvariablesforeachunfinishedcall). (fordataflowanalysis).Becausethenumberofconfigurationsofa
pushdownsystemisunbounded, itisusefultousefiniteautomata
2.2 PushdownSystems todescriberegularsetsofconfigurations.
ThesemanticsofaBooleanprogramcanbegivennicelyinterms DEFINITION2. IfP =(P,Γ,∆)isapushdownsystemthenaP-
ofPDSs. automatonisafiniteautomaton(Q,Γ,→,P,F),whereQ⊇P is
afinitesetofstates,→⊆Q×Γ×Qisthetransitionrelation,P is
DEFINITION1. A pushdown system is a triple P = (P,Γ,∆), thesetofinitialstates,andF isthesetoffinalstates.Wesaythata
whereP isafinitesetofstatesorcontrollocations,Γisafiniteset
configurationhp,uiisacceptedbyaP-automatoniftheautomaton
ofstacksymbols,and∆⊆P ×Γ×P×Γ∗isafinitesetofrules. canacceptuwhenitisstartedinthestatep(writtenasp −→u ∗ q,
AconfigurationofP isapairhp,uiwherep ∈ P andu ∈ Γ∗.
whereq ∈F).AsetofconfigurationsiscalledregularifsomeP-
A rule r ∈ ∆ is written as hp,γi ֒→ hp′,ui, where p,p′ ∈ P,
automaton accepts it. Without loss of generality, P-automata are
γ ∈ Γ and u ∈ Γ∗. These rules define a transition relation ⇒
restrictedtonothaveanytransitionsleadingtoaninitialstate.
on configurations of P as follows:If r = hp,γi ֒→ hp′,ui then
hp,γu′i ⇒ hp′,uu′i for all u′ ∈ Γ∗. The reflexive transitive An important result is that for a regular set of configurations
closureof⇒isdenotedby⇒∗.ForasetofconfigurationsC,we C, both post∗(C) and pre∗(C) (the forward and the backward
define pre∗(C) = {c′ | ∃c ∈ C : c′ ⇒∗ c} and post∗(C) = reachablesetsofconfigurations,respectively)arealsoregularsets
{c′ | ∃c ∈ C : c ⇒∗ c′},whicharejustbackwardandforward ofconfigurations [5,9].Thealgorithmsforcomputing post∗ and
reachabilityunderthetransitionrelation⇒. pre∗,calledpoststarandprestar,respectively,takeaP-automaton
A as input, and if C is the set of configurations accepted by A,
Without loss of generality, we restrict the pushdown rules to theyproduceP-automataApost∗ andApre∗ thatacceptthesetsof
haveatmosttwostacksymbolsontheright-handside[42]. configurationspost∗(C)andpre∗(C),respectively[5,13,14].
EncodingBooleanprograms.Thestandardapproachformod-
elingtheprogramcontrolflowwithapushdown systemisasfol- 2.3 ConcurrentBooleanProgramsandCBMC
lows:P containsasinglestate{p},Γcorrespondstotheprogram AconcurrentBooleanprogramisasetofBooleanprograms(one
locations,and∆correspondstoedgesoftheCFG(seeFig.2). foreachthread)wheretheglobalvariablesaresharedbetweenthe
ForencodingBooleanprogramswithPDSs,thestatealphabet
threads.Thus,anyofthethreadscanmodifytheglobalvariables,
P is expanded to encode the values of global variables, and the buttheyhavetheirowncopyofthelocalvariables.Synchronization
stackalphabetisexpandedtoencodethevaluesoflocalvariables
iseasilyimplementableusingglobalvariablesaslocks.Analysisof
[42].LetGbethesetofvaluationsofglobalvariables,Valibethe suchmodelsisundecidable ingeneral [38],i.e.,itisnotpossible
setofvaluationsoflocalvariables,andNibethesetofcontrollo- to verify if a given configuration is reachable or not. However,
cationsoftheithprocedure.Theeffectofexecutinganassignment QadeerandRehofhaveshownthatCBMCisdecidable.Letnbe
or assume statement st, denoted as [[st]], is a binary relation on thenumberofthreadsandlett1,t2,··· ,tndenotethethreads.We
G×Valithatdescribeshowvaluesofvariablesinscopecanchange. donotconsiderdynamiccreationofthreadsinourmodel.1
WesetP tobeG,andΓtobetheunionofN ×Val overallproce-
i i LetGbethesetofglobalstates(valuationsofglobalvariables)
dures(notethatthesetoflocalstatesLequalsΓ∗).Rulesfortheith andL bethesetoflocal statesoft (asdescribed before).Then
i i
procedureareconstructedasfollows:(i)aCFGedgeu→vwitha the state space of the entire program consists of the global state
statementstisencodedasasetofruleshg,(u,l)i֒→hg′,(v,l′)i
suchthat ((g,l),(g′,l′)) ∈ [[st]]; (ii) aprocedure returnatnode 1Dynamic creation up to n threads can be encoded in the model [36].
uisasetofruleshg,(u,l)i ֒→ hg,εiforeach(g,l) ∈ G×Vali; Moreover, forCBAthatconsiders k contextswitches,ncanbebounded
(iii) a call edge c → r that calls procedure f, with entry node bykbecauseotherthreadswouldnevergetachancetorun.
pairedwithlocalstatesofeachofthethreads,i.e.,thesetofstates (g00, S0, T0)
isG×L1×···×Ln.Aconcurrentprogramcanberepresented R = post*(g , S)
bynPDSs,oneforeachthread,wherethePDSssharethesameset 1 00 0
ofglobalstatesG. (R, T)
0
Let the transition relation of thread t be ⇒ , which is a bi-
i ti
nary relation on G × L as described in the previous section.
If (g,li) ⇒ti (g′,li′), thie transition (g,l1,··· ,li,··· ,ln) ⇒cti (g11, S1, T0) (g12, S2, T0) ... (g1m, Sm, T0)
(g′,l1··· ,li′,··· ,ln)isavalidtransitionfortheconcurrentpro- R’= post2*(g12, T0)
gram.
Theexecutionofaconcurrentprogramproceedsinasequence (S2, R’)
ofexecutioncontexts.Inanexecutioncontext,onethreadhascon- ... ...
trol and it executes a finite number of steps. The execution con-
textchangesatacontextswitchandcontrolispassedtoadifferent (g21, S2, T1) (g22, S2, T2) ... (g2p, S2, Tp)
thread.TheCBMCproblemistofindthesetofreachablestatesin
Figure3. ThecomputationoftheQRalgorithm,fortwothreads,
thetransitionrelationoftheconcurrentprogramunderaboundon
shown schematically inthe form of a tree. The shaded boxes are
the number of context switches. Formally, let k be the bound on
justtemporaryplaceholdersandarenotinsertedintotheworklist.
contextswitches.Thentherearek+1executioncontexts.Let⇒c
1 ThethickarrowscorrespondtoStep3andotherarrowscorrespond
be(∪n (⇒c )∗),thetransitionrelationthatdescribestheeffectof
i=1 ti toStep4.Thesetoftuplesatleveliofthetreecorrespondtoall
one execution context. Then we wish to find the reachable states
statesreachedinicontextswitches.
inthetransitionrelationgiven by(⇒c)k+1.Thereachable states
1
couldbeused,forexample,tofindoutthedatavalueswhent1 is
atnoden1andtherestofthethreadscanbeanywhere,orwhent1 tj ispickedthatgetstoexecuteinthatcontext.Thenstep3finds
isatn1andt2isatnoden2andsoon.Notethatwhileaboundis allstatesthatexecutionoftj canproduce. Foreachoftheglobal
placedonthenumber ofcontext switches,nobound isplacedon statesgp that can be produced, it ispassed to allother threadsat
thelengthofanindividualexecutioncontext. the context switch in step 4. The set of tuples (η,i) with i = k
representthesetofallreachablestates.Thecomputationperformed
2.4 TheQadeer-RehofAlgorithmforCBMC bythisalgorithmisdepictedinFig.3intheformofatree.
Animportantaspectofthealgorithmisthewayitmanipulates
TheQadeer-Rehof(QR)algorithmworksundertheassumptionthat
the set G is finite. Under such an abstraction, the only source of setofstates.Anitemontheworklistisoftheform(g,S1,··· ,Sn),
representingasetofstates.Theglobalstateg iskeptexplicitbe-
unboundednessistheprogramstack.
causeitisrequiredforsynchronizationacrossthreadsatacontext
Thealgorithmproceedsbyiterativelyincreasingthenumberof
switch.Thelocalstatesneednotbekeptexplicit,andtheyarecol-
executioncontexts.Withinoneexecutioncontext,theglobalstate
lected in the sets S . This is important because the set of local
can be considered local to the executing thread because it is the i
statescanbeinfinite.ThesetsS arekeptinsymbolicformusing
onlythreadthataccessesit.Atacontextswitch,theglobalstateis i
automata(Defn.2).Thepoststaralgorithmworksontheserepre-
synchronized with other threads so that they have the same view
sentations,mappingautomata(capturingstartingconfigurations)to
of the shared memory. The algorithm needs G to be finite to be
automata(capturingreachableconfigurations).
abletoexploreallpossibilitiesatacontextswitch.Weonlygivean
overviewoftheQRalgorithmintermsofexplicitstatespaces.Its
3. NewAlgorithmforCBMCUsingTransducers
implementationusingPDSsisdescribedin[36].
IfSi ⊆ Li isasetoflocalstates,thenlet(g,S1,S2,··· ,Sn) TheQR algorithmfailsto generalize toinfinite-stateabstractions
bethesetofstates{(g,l1,··· ,ln)|li ∈Si}.Weusethesymbol because of itsrequirement tokeep the global stateexplicit inthe
η as a shorthand for such a set of states. The QR algorithm is a worklist items. After each context switch, the algorithm does a
worklist-basedalgorithm.Anitemontheworklistisapair(η,i), “fan-out”proportionaltothesizeoftheglobalstatespace|G|(see
denoting that the set of states η is reachable in up to i context Fig.3)topasstheglobalstatetoallotherthreads.Thisisalsotrue
switches.Initially,theworklistcontains(ηinit,0),whereηinit isthe fortheautomaton-basedimplementationoftheQRalgorithm.The
starting set of states for the program. Then the algorithm repeats algorithmpresentedinthissectionavoidssuchafan-out(andwill
thefollowingstepsuntiltheworklistisempty. beextendedtoinfinite-stateabstractionsin§5and§6).
TheQRalgorithmmakesseveralcallstothePDS-basedalgo-
1. Selectand removeanitem(η,i) fromtheworklist. Ifi = k,
rithmpoststartocomputetheforwardreachablestatesinasingle
thenthecontextboundhasbeenreached,sopickanotheritem.
thread.Thisiscrucialtobeabletoworkwithinfinitesetsofconfig-
2. Letη = (g,S1,··· ,Sn).Foreachj from1ton,repeatsteps urations.However,thedisadvantageisthatpoststarrequiresastart-
3and4. ingsetofconfigurationstofindallofthereachableconfigurations.
Creationofthisstartingsetiswhatforcesthefan-outoperationto
3. Using a thread-local analysis on t , find the set of states that
j alternatewithcallstopoststar.
t can reach when started from the set of states (g,S ). Let
j j Asimilarproblemarisesininterproceduralanalysisofsequen-
this set be R , i.e., (g,S ) ⇒∗ R . In PDS terms, R =
j j tj j j tialprograms:aprocedurecangetcalledfrommultipleplaceswith
post∗ ((g,S )).WriteR as∪m (g ,Rp).Thisimpliesthat
tj j j p=1 p j multiple different input values. Instead of reanalyzing the proce-
thread t can change the global state from g to g and itself
j p dureforeachinputvalue,itisanalyzedindependentlyofthecalling
reachsomelocalstateinRp.
j contexttocreateasummary.Thissummaryconciselydescribesthe
4. Foreachg producedintheabovestep,thesetofstatesη = effect of executing theprocedure in any calling context, interms
p p
(gp,S1,··· ,Sj−1,Rjp,Sj+1,··· ,Sn) are reachable in up to oftherelationbetweeninputtotheprocedureanditsoutput.Sim-
i+1contextswitches.Insert(η ,i+1)intotheworklist. ilarly,insteadofreanalyzingathreadeverytimeitreceivescontrol
p
after acontext switch, we createa summary for it. Thedifficulty
Steps 3 and 4 take a starting set of states η and produce all isthat the“input” hereisastartingsetof configurations, andthe
states that are reachable in one execution context. First, a thread “output”isthereachablesetsofconfigurations.Bothofthesesets
canbeinfinite,andthesummarymusthavesomesymbolicrepre- showbelow—allowsittobeextendedtoinfinite-statedataabstrac-
sentation.Weconstructthesummaryusingafinite-statetransducer tions. To make this extension, we represent (recursive) programs
(anautomatonwithinputandoutputtapes). with infinite-state abstractions using WPDSs(§4). Extending our
algorithmtoWPDSspresentstwochallenges:oneistheconstruc-
DEFINITION3. A finite-state transducer τ is a tuple tion of a weighted transducer for a WPDS,and the other istheir
(Q,Σi,Σo,λ,I,F),whereQisafinitesetofstates,ΣiandΣoare composition.Theseissuesareaddressedin§5and§6,respectively.
inputandoutputalphabets,λ⊆Q×(Σ ∪{ε})×(Σ ∪{ε})×Q
i o
is the transition relation, I ⊆ Q is the set of initial states, and
4. WeightedPushdownSystems
F ⊆ Q is the set of final states. If (q1,a,b,q2) ∈ λ, writtenas
q1 −−a−/→b q2, we say that the transducer can go from state q1 to A weighted pushdown system is obtained by augmenting a PDS
q2 oninputa,andoutputsthesymbolb.Givenastateq ∈ I,we with a weight domain that is a bounded idempotent semiring [6,
say that thetransducer can accept astring σ ∈ Σ∗ withoutput 40].Suchsemiringsarepowerfulenoughtoencodefinite-statedata
i i
σ ∈ Σ∗ ifthere isapath fromstateq toafinal statethat takes abstractions,suchastheonerequiredforbitvectordataflowanaly-
o o
input σ and outputs σ . The language of the transducer L(τ) sis,Booleanprogramverification,ortheIFDSframeworkofReps-
i o
is defined as the following subset of Σ∗ ×Σ∗ : {(σ ,σ ) | the Horwitz-Sagiv[39],aswellasinfinite-statedataabstractions,such
i o i o
transducercanoutputstringσ whentheinputisσ }. aslinear-constantpropagationandaffine-relationanalysis[29].We
o i
recallsomeofthishere,butdetailsonusingWPDSsforinterpro-
GivenaPDSP,onecanconstructatransducerτP whoselan- ceduralanalysiscanbefoundin[40].
guageequals⇒∗,thetransitiveclosureofP’stransitionrelation. Weights encode the effect that each statement (or PDS rule)
ThisresultwasfirstgivenbyCaucal[10],butitwasnotaccompa- has on the data state of the program. They can be thought of as
niedwithacomplexityresult,exceptthatitwaspolynomialtime. abstract transformers, that specify how the abstract state changes
OurconstructionoftransducersforWPDSs(strictlymoregeneral whenastatementisexecuted.WPDSscomputeovertheseweights.
thanCaucal’sresult)makesuseofrecentadvancementsintheanal- Computing over transformers, instead of the underlying abstract
ysisof(W)PDSs[5,13,40,42]foranefficientconstruction.Since states,iscustomaryforinterproceduralanalysis[12,22,39]where
suchtransducersareofgeneralimportance,wegiveacomplexity proceduresummariesneedtobecalculatedastransformationson
result.ThefollowingtheoremisderivedfromThm.2givenin§5. abstractstates.
THEOREM1. GivenaPDSP = (P,Γ,∆),atransducerτP can DEFINITION4. A bounded idempotent semiring is a tuple
be constructed such that it accepts input (p1 u1) and outputs (D,⊕,⊗,0,1), where D is a set whose elements are called
(p2 u2)ifandonlyifhp1,u1i ⇒∗ hp2,u2i.Moreover,thistrans- weights, 0,1 ∈ D, and ⊕ (the combine operation) and ⊗ (the
ducercanbeconstructedintimeO(|P||∆|(|P||Γ|+|∆|))andhas extendoperation)arebinaryoperatorsonDsuchthat
atmost|P|2|Γ|+|P||∆|states.
1. (D,⊕)isacommutativemonoidwith0asitsneutralelement,
Theadvantageofusingtransducersisthattheyareclosedunder andwhere⊕isidempotent.(D,⊗)isamonoidwiththeneutral
relationalcomposition. element1.
2. ⊗distributesover⊕,i.e.,foralla,b,c∈Dwehave
LEMMA1. Given transducers τ1 and τ2 with input and output a⊗(b⊕c)=(a⊗b)⊕(a⊗c)and(a⊕b)⊗c=(a⊗c)⊕(b⊗c).
alphabet Σ, one can construct a transducer (τ1;τ2) such that 3. 0 is an annihilator with respect to ⊗, i.e., for all a ∈ D,
L(τ1;τ2) = L(τ1);L(τ2). Similarly, if A is an automaton with a⊗0=0=0⊗a.
alphabet Σ, one can construct an automaton τ1(A) such that its
languageistheimageofL(A)underL(τ1),i.e.,theset{u∈Σ∗ | 4. Inthepartialorder⊑definedby∀a,b∈D, a⊑biffa⊕b=a,
∃u′ ∈L(A),(u′,u)∈L(τ1)}. therearenoinfinitedescendingchains.
Bothoftheseconstructionsarecarriedoutinamannersimilarto DEFINITION5. A weighted pushdown system is a triple W =
automaton intersection[18].Forcomposing transducers, for each (P,S,f) where P = (P,Γ,∆) is a pushdown system, S =
transitionp −−a−/→b qinτ1 andtransitionp′ −b−/→c q′ inτ2,addthe (D,⊕,⊗,0,1)isaboundedidempotentsemiringandf :∆→D
transition(p,p′)−−a−/→c (q,q′)totheircomposition.Fortransducer- isamapthatassignsaweighttoeachruleofP.
wauittohmtraatonnsitaiopnplipc′at−io→an,eqa′chintrAanstoitipornodpu−c−ae−/→tbranqsiitnioτn1(ips,mpa′)tch−→ebd Letσ∈∆∗beasequenceofrules.Usingf,wecanassociatea
(q,q′)inτ1(A).Onecanalsotaketheunionoftransducers(union valuetoσ,i.e.,ifσ=[r1,...,rk],thenwedefinev(σ)=def f(r1)⊗
oftheirlanguages)inamannersimilartounionofautomata. ...⊗f(rk).Moreover,foranytwoconfigurationscandc′ofP,we
ComingbacktoCBMC,eachthreadisrepresentedusingaPDS. usepath(c,c′)todenotethesetofallrulesequencesthattransform
Thus,wecanconstruct atransducer τ forthetransitionrelation cintoc′.Ifσ ∈ path(c,c′),thenwesayc ⇒σ c′.Reachability
ti
⇒∗. By extending τ to perform the identity transformation on problemsonPDSsaregeneralizedtoWPDSsasfollows:
ti ti
stacksymbolsofthreadsotherthant (usingtransitionsoftheform
p−−γ−/→γ q),weobtainatransducerτci for(⇒c )∗.Next,aunionof DEFINITION6. LetW = (P,S,f)beaweightedpushdownsys-
these transducers gives τc, which rteipresentst⇒i c. Performing the tem,whereP =(P,Γ,∆),andletS,T ⊆P ×Γ∗beregularsets
compositionofτc k time1swithitselfgivesusa1transducer τ that ofconfigurations.Thenthemeet-over-all-pathsvalueMOP(S,T)
represents(⇒c1)k1+1.IfanautomatonAcapturesthesetofstarting isdefinedasL{v(σ)|s⇒σ t,s∈S,t∈T}.
states of the concurrent program, τ(A) gives a single automaton Wecallboundedidempotentsemiringsweightdomains.
forthesetofallreachablestatesintheprogram(underthecontext A PDS is simply a WPDS with the Boolean weight domain
bound). ({0,1},⊕,⊗,0,1)andweightassignmentf(r) = 1forallrules
r ∈ ∆. In this case, MOP(S,T) = 1 iff there is a path from a
RoadmapfortheRemainderofthePaper configurationinS toaconfigurationinT,i.e.,post∗(S)∩T and
Webelievethattheabovealgorithmprovidesabetterbasisforim- S∩pre∗(T)arenon-emptysets.
plementing a tool for CBMC than the QR algorithm. In particu- One way of modeling programs as WPDSs is as follows: the
lar,thenew algorithmavoidsthefan-out problem, which—aswe PDS models the control flow of the program, as in Fig. 2. The
weightdomainmodelsabstracttransformersforanabstractionof proc foo proc bar
the program’s data. The next two sections describe two data ab- n
n 5
stractionsthatcanbeencodedusingweightdomains.Forsimplic- 1
ity, we only show the treatment for global variables, and do not x := 0 x1:= x1+ x2
considerlocalvariables.Localvariables(underaninfinite-stateab- 1
straction) pose an extra complication for WPDSs [25], and their n2 n6
treatmentcanbefoundinApp.B.Finite-stateabstractionoflocal x := 1 bar( )
2
variablescanalwaysbeencodedinthestackalphabet,asforPDSs. n n7
3
4.1 Finite-StateAbstractions bar( ) x2:= x2 + 1
An important weight domain for WPDSs is the set of all binary n n
4 8
relationsonafiniteset.
Figure5. Anaffineprogramthatstartsexecutionatnoden1.There
DEFINITION7. IfGisafiniteset,thentherelationalweightdo- aretwoglobalvariablesx1andx2.
main on G is defined as (2G×G,∪,;,∅,id): weights are binary
relationsonG,combineisunion,extendisrelationalcomposition,
0istheemptyrelation,and1istheidentityrelationonG. Theminpathsemiringcanbecombinedwitharelationalweight
domain,forexample,tofindtheshortest(valid)pathinaBoolean
Instantiating G to be the set of global states of a Boolean program(forfindingtheshortesttraceexhibitingsomeproperty).
program, we obtain a weight domain for Boolean programs. The
weightassociatedwitharuleisitseffectontheglobalstate,which, DEFINITION9. A weighted relation on a set S, weighted with
asdescribed earlier,isabinary relation onG. (Methods for han- semiring (D,⊕,⊗,0,1), is a function from (S × S) to D. The
dling local variables can be found in [25, 42].) An example is composition of two weighted relations R1 and R2 is defined
showninFig.4(b).TheBooleanprogramhastwovariablesrang- as (R1;R2)(s1,s3) = ⊕{w1 ⊗ w2 | ∃s2 ∈ S : w1 =
ingoverthesetV,soG = V ×V,withthefirstcomponent be- R1(s1,s2),w2 = R2(s2,s3)}.Theunionofthetwoweightedre-
ingthevalueofx.Weightsareshownusingashorthandnotation, lationsisdefinedas(R1∪R2)(s1,s2)=R1(s1,s2)⊕R2(s1,s2).
e.g., ((v1,v2),(v1,v1)) represents the set {((v1,v2),(v1,v1)) | Theidentityrelationisthefunctionthatmapseachpair(s,s)to1
v1,v2 ∈V}. andothersto0.Thereflexive-transitiveclosureisdefinedinterms
Thesetofalldatavaluesthatreachanodencanbecalculated of these operations, as before. If → is a weighted relation and
as follows: let S be the singleton configuration consisting of the (s1,s2,w)∈→,thenwewrites1−−w→s2.
program start node and T be the set {hp,nui | u ∈ Γ∗}. Let
w = MOP(S,T). If w = 0, then the node cannot be reached. DEFINITION10. If S is a weight domain with set of weights D
Otherwise, w captures the net transformation on the global state andGisafiniteset,thentherelationalweightdomainon(G,S)is
fromwhentheprogramstarted.Therangeofw,i.e.,theset{g ∈ defined as(2G×G→D,∪,;,∅,id):weightsareweightedrelations
G | ∃g′ ∈ G : (g′,g) ∈ w}),istheset ofvaluations thatreach onGandtheoperationsarethecorrespondingonesforweighted
noden.Forexample,inFig.4,theMOPweighttonoden6 isthe relations.
weightw6showninthefigure.Itsrangeshowsthatx= y= 3or IfGisthesetofglobalstatesofaBooleanprogram, thenthe
x=y=7.
relational weight domain on (G,M) can be used for finding the
Because T can be any regular set, one can also make stack-
shortesttrace:foreachrule,ifR⊆G×Gistheeffectofexecut-
qualifiedqueries[40].Forexample, thesetof valuesthatariseat
ingtheruleontheglobalstateoftheBooleanprogram,thenasso-
nodenwhenitsprocedureiscalledfromcall-sitemcanbefound
bysettingT ={hp,nmui|u∈Γ∗} ciatethe following weight withthe rule: (λ(g1,g2).if((g1,g2) ∈
AWPDSwithaweightdomainthathasafinitesetofweights, R)then1else∞).Then,ifw = MOP(C1,C2),thelengthofthe
shortestpaththatstartswithglobalstategfromaconfigurationin
suchastheonedescribedabove,canbeencodedasaPDS.How-
ever, it is often useful to use weights because they can be sym- C1andendsatglobalstateg′inaconfigurationinC2,isw(g,g′)
(whichwouldbe∞ifnopathexists).Suchaweightdomainisa
bolicallyencoded.ToolssuchasMOPED,BEBOP,andBLASTuse
smallextensionoverthepurerelationaldomainforaBooleanpro-
BDDs to encode sets of data values, allowing them to scale to a
gram. However, theQRalgorithm cannot handle thisabstraction,
largenumberofvariables.UsingPDSsforBooleanprogramveri-
whereasthealgorithmwegavein§3canbegeneralizedtohandle
fication,withoutanysymbolicencoding,wouldnotbefeasible.
it(asshownin§5and§6).
4.2 Infinite-StateAbstractions
4.2.1 Affine-RelationAnalysis
Aninfinite-stateabstractionisoneinwhichthenumberofabstract
An affine relation is a linear equality constraint between integer-
states(orweights)isinfinite.Webeginwithsomesimpleexamples
valued variables. Affine-relation analysis (ARA) tries to find all
ofinfinite-weightdomains,andthendiscusstheoneusedforaffine-
affinerelationshipsthatholdintheprogram.Anexampleisshown
relationanalysis.
in Fig. 5. For this program, ARA would, for example, infer that
DEFINITION8. TheminpathsemiringistheweightdomainM= x2 =x1+1atprogramnoden4.
(N ∪{∞},min,+,∞,0): weights are non-negative integers in- ARA for single-procedure programs was first given by Karr
cluding“infinity”,combineisminimum,andextendisaddition. [21]. It took almost 30 years to develop an analysis for multi-
procedure programs [29]. Using the results of this paper, we can
IfallrulesofaWPDSaregiventheweight1fromthissemiring extendARAtodealwith(context-bounded) concurrency.Thead-
(different from the semiring weight 1, which is the integer 0), vantageofourframeworkisthatwegetaCBAautomaticallyfrom
thentheMOPweightbetweentwoconfigurationsisthelengthof aninterproceduralanalysis.
the shortest path (shortest rule sequence) between them. Another ARAgeneralizesotheranalyses,includingcopy-constantprop-
infinite-weightdomain,basedontheminpathsemiring,isgivenin agation, linear-constant propagation [41], and induction-variable
[24]andwasshowntobeusefulfordebuggingprograms. analysis [21]. We have used ARA (for sequential programs) on
n,1 n,w
1 2 1
n,w n,w
barnn(x 24)=3pnr6onc1 foox=nn7b35ar( ) pyr=oxcnn b78ar hhhhhhhhpppppppp,,,,,,,,nnnnnnnn34578112iiiiiiii֒֒֒֒֒֒֒֒→→→→→→→→hhhhhhhhpppppppp,,,,,,,,nnnnεnnni7668237iiiiinn54ii 11111www312 ennpeenne78,,,78ww1,,w133n353,w52n1,wqnn664 4,,wwn6442,wn35,wa5cc wwwwww123456 ((((((((((((((vvvvvvv1111111,,,,,,,vvvvvvv2222222))))))),,,,,,,(((((((v3737371,,,,,,,vv3737v22))))))))1)))))∪)
n,w n,1
p 3 3 4 acc
n,1 n,1
5 6
(a) (b) (c) (d)
Figure4. (a)ABooleanprogramwithtwoproceduresandtwoglobal variablesxandyoverafinitedomainV = {0,1,··· ,7}.(b)A
WPDSthatmodelstheBooleanprogram.(c)Theresultofpoststar(hp,n1i)andprestar(hp,n6i).Thefinalstateineachoftheautomatais
acc.(d)Anindexoftheweightsusedinthisfigure.Theunboundvariablesv areuniversallyquantifiedoverV.
i
machinecodetofindinduction-variablerelationshipsbetweenma- holdsaftertheexecutionofthestatementifandonlyiftheaffine
chine registers [2]. These help in increasing the precision of an relations(m1~a),(m2~a),··· ,(mr~a)held beforetheexecution of
abstract-interpretationbasedpointeranalysisformachinecode. thestatement.
Under suchanabstractionofprogramstatements,onecande-
TheAnalysis finetheextendoperation,whichistransformercomposition,asel-
ementwisematrixmultiplication,andthecombineoperationasset
Interprocedural ARA can be performed precisely on affine pro-
union.Thisiscorrectsemantically,butitdoesnotgiveaneffective
grams, and has been thefocus of several papers [16,21, 29,30].
algorithmbecausethematrixsetscangrowunboundedly.However,
AffineprogramsaresimilartoBooleanprograms,butwithinteger-
theobservationthataffinerelationsformavectorspacecarriesover
valued variables. Again, we restrict our attention to global vari-
to a set of matrices as well. One can show that the transformer
ables,anddefertreatmentoflocalvariablestoApp.B.Allbranch
conditions inaffineprogramsarenon-deterministic (ARAcannot {m1,m2,··· ,mr} is semantically equivalent to the transformer
interpretconditions).If{x1,x2,··· ,xn}isthesetofglobalvari- {m1,m2,··· ,mr,m},wheremisanylinearcombinationofthe
ables of the program, then all assignments have the form x := mimatrices.Thus,asetofmatricescanbeabstractedasthe(infi-
j
asi0gn+mPentni=ca1naailxsio,bwehneoren-ad0e,te·r·m·i,naisntica,redeinntoetgeedrbcyoxnst:a=nts?.,Awnhiacsh- nwietec)asnetroepfrmesaetrnitcietsusspianngnietsdbbaysitshetomg.eOtnacfienwiteehaanvdeaabvoeucntodresdpraecpe-,
j
mayassignanyinteger tox .(Thisistypicallyusedforabstract- resentation:avectorspaceover(n+1)×(n+1)sizedmatrices
ingassignmentsthatcannotjbemodeledasalinearfunctionofthe cannothavemorethat(n+1)2numberofmatricesinitsbasis.
variables.) If M is a set of matrices, let SPAN(M) be the vector space
spanned by them. Letβ bethebasisoperation that takesaset of
ARAWeightDomain matricesandreturnsabasisoftheirspan.Wecannow definethe
weightdomain.Aweightwisavectorspaceofmatrices,whichcan
We briefly describe the weight domain based on the matrix-
0forimsurleaptiroenseonfteAdRAusifnrogmc[o2l9u]m.Annvaefcfitonreroeflatsiioznean0++P1ni=a1sa~aixi== bisethreepvreescetonrtesdpaucsein{g(mits1bmas2i)s.|Emxtie∈ndwoif}v.eCcotomrbsipnaeceosfww11aannddww22
f(rao0m,at1h,e··s·et,aonf)gtl.oAbalvavlauraiatibolnesotfoptrhoegrianmtegvearrsi.aTblhees vxaliuseaomfaxp ivsetchtoervsepcatcoerscpoanctaein{i(nmg1bo+thmw21)a|nmdiw∈2.w0iis},thweheimchpitsytsheet,samndal1leisst
i thespanofthesingletonsetconsistingoftheidentitymatrix.The
underthisvaluationiswrittenasx(i).
extend and combine operations, as defined above are operations
Avaluationxsatisfiesanaffinerelation~a=(a0,a1,···,an)t on infinite sets. They can be implemented by the corresponding
iafllav0a+luaPtionin=s1tahiaxt(sia)ti=sfy0.itA,wnraifttfiennearselPaTtiSo(n~a~a).rAepnreasffienntesrtehleatsieotno~af oshpoewrattihoantsiotnistsheembaanstiiscaolflythceorwreecitghtotso.pTehraetefoollnowthiengelpemroepnetrstieins
holdsataprogramnodeifthesetofvaluationsreachingthatnode
thebasisinsteadofalltheelementsinthevectorspacespannedby
(inthecollectingsemantics)isasubsetofPTS(~a). them:
Animportantobservationaboutaffineprogramsisthatifaffine
oreflatthioeinrsl~ain1eaarndco~am2bihnoaltdionats.aFporrogerxaammpnloe,deo,ntehecnansovedroifeys tahnayt β(w1⊕w2) = β(β(w1)⊕β(w2))
PTS(~a1+~a2)⊇PTS(~a1)∩PTS(~a2),i.e.,theaffinerelation~a1+~a2 β(w1⊗w2) = β(β(w1)⊗β(w2))
(componentwiseaddition)holdsataprogramnodeifboth~a1 and Thesepropertiesaresatisfiedbecauseofthelinearityofextend
~a2holdatthatnode.Therefore,thesetofaffinerelationsthathold (matrixmultiplicationdistributesoveraddition)andcombineoper-
ataprogramnodeformavectorspace.Thisimpliesthata(possibly ations.
infinite) set of affine relations can be represented by its linearly Undersuchaweightdomain,MOP(S,T)isaweightthatisthe
independentbasis(whichisalwaysafiniteset). net weakest-precondition transformer between S and T.Suppose
For reasoning about affine programs, each statement is ab- thisweighthasbasis{m1,··· ,mr}.Theaffinerelationrepresent-
stractedbyasetofmatricesofsize(n+1)×(n+1)(thisabstrac- ingthatanyvariablevaluationmightholdatSis~0=(0,0,··· ,0).
tionturnsouttobeprecise,i.e.,itisabletofindallaffinerelation- Thus,~0holdsatS,andtheaffinerelation~aholdsatT iffm1~a =
ships intheaffineprogram). Thisset istheweakest-precondition m2~a = ··· = mr~a = ~0.Thesetofallaffinerelationsthathold
transformeronaffinerelationsforthatstatement:ifastatementis atT canbefoundastheintersectionofnullspacesofthematrices
abstractedastheset{m1,m2,··· ,mr},thentheaffinerelation~a m1,m2,··· ,mr.
ExtensionstoARA LEMMA2. [40] Given a WPDS with PDS P = (P,Γ,∆), if
A=(Q,Γ,→,P,F)isaP-automatonthatacceptsaninputsetof
ARA can also be performed for modular arithmetic to precisely
configurations,poststarproducesabackwardweightedautomaton
model machine arithmetic (which is modulo 2 to the power of
the word size) [30]. Our result for CBA holds for both integer withatmost|Q|+|∆|statesintimeOs(|P||∆|(|Q0|+|∆|)H+
arithmeticandmodulararithmetic,butweonlyfocusontheformer |P||λ0|H),whereQ0 =Q\P,λ0 ⊆→isthesetofalltransitions
inthispaper. leadingfromstatesinQ0,andHistheheightoftheweightdomain.
ARA in the presence of branch conditions is undecidable in Theheightofaweightdomainisdefinedtobethelengthofthe
general.However,thereareapproximationtechniques[31],which longestdescendingchaininthedomain.Inthispaper,weassume
wecanmakeuseofbygivingupthedistributivitypropertyinplace theheighttobeboundedforeaseofdiscussingcomplexityresults,
ofmonotonicity(see§4.3).Theapproximationtechniquesaresafe butWPDSs,andthealgorithmsinthispaper, canalsobeusedin
forinterproceduralanalysis,andalsoforCBA,ascarriedoutusing certaincaseswhentheheightisunbounded(aslongasthereareno
thealgorithmsfromthispaper. infinitedescendingchains,asisthecaseforMinDefn.8).
4.3 SolvingfortheMOPValue Approximateanalysis
There are two algorithms for solving for MOP values, called Among the properties imposed by a weight domain, one impor-
prestar and poststar (by analogy with the algorithms for PDSs). tantpropertyisdistributivity(Defn.4,item2).Thisisacommon
Theytakeasinputanautomatonthatacceptsthesetofinitialcon- requirement for apreciseanalysis, alsoconsidered invarious co-
figurations.Asoutput,theyproduceaweightedautomaton: incidencetheoremsfordataflow analysis[20,22,43].Sometimes
thisrequirementistoostrictandmayberelaxedtomonotonicity,
DEFINITION11. Given a weighted pushdown system W =
i.e., for all a,b,c ∈ D, a⊗(b⊕c) ⊑ (a⊗b)⊕(a⊗c) and
(P,S,f),aW-automatonAisaP-automaton,whereeachtran-
(a⊕b)⊗c⊑(a⊗c)⊕(b⊗c).Insuchcases,theMOPcomputa-
sitionintheautomaton islabeledwithaweight. Theweight of a
tionmaynotbeprecise,butitwillbesafeunderthepartialorder⊑.
pathintheautomatonisobtainedbytakinganextendoftheweights
Thesameappliesfortheresultsinthispaper.Whendistributivity
onthetransitionsinthepathineitheraforwardorbackwarddi-
holds,ourCBAisprecise,otherwise,ifonlymonotonicityholds,it
rection.Theautomatonissaidtoacceptaconfigurationc=hp,ui
willbeasafeapproximation.
withweightw=A(c)ifwisthecombineofweightsofallaccept-
ingpathsforustartingfromstatepinA.Wecalltheautomatona
4.4 CBAProblemDefinition
backwardW-automatoniftheweightofapathisreadbackwards,
andaforwardW-automatonotherwise. ThetransitionrelationofaWPDSisaweightedrelation(Defn.9)
over the set of PDS configurations. For configurations c1 and
Let A be an unweighted automaton and L(A) be the set of c2, if r1,··· ,rm are all the rules such that c1 ⇒ri c2, then
configurations accepted by it. Then, prestar(A) produces a for- (c1,c2,⊕if(ri)) is in the weighted relation of the WPDS. In a
wardweightedautomatonApre∗ asoutput,suchthatApre∗(c) = slight abuse of notation, we will use ⇒ and its variants for the
MOP({c},L(A)), whereas poststar(A) produces a backward weightedtransitionrelationofaWPDS.Notethattheweightedre-
weighted automaton Apost∗ as output, such that Apost∗(c) = lation⇒∗mapstheconfigurationpair(c1,c2)toMOP({c1},{c2}).
MOP(L(A),{c}) [40]. An example is shown in Fig. 4(c). One TheCBAproblemisdefinedasin§2.3,exceptthatallrelations
thingtonotehereishowthepoststarautomatonworks.Thepro- areweighted.ThismeansthateachthreadismodeledasaWPDS.
cedure bar is analyzed independently of its calling context (not ThethreadssharePDSstatesoftheWPDSs,aswellastheweights
knowing the exact value of x), resulting in transitions between p (theformercanbeeliminated,because PDSstatescanbepushed
andq.Itscallingcontext,havingtheinputvalues,isrepresentedus- insidetheweights).
ingthetransitionscomingoutofstateq.Thisishow,forinstance, Thisproblemdefinitionallowsonetopreciselymodelconcur-
the automaton can tell that x = y = 3 at node n8 when bar is rentBooleanprograms(withvariationssuchasfindingtheshortest
calledfromthe(n3,n4)edge. trace), as well as concurrent affine programs, where both are de-
Using standard automata-theoretic techniques, one can also finedashavingmultiplethreadsandsharedglobalvariables.
compute Aw(C) for (forward or backward) weighted automa- Given the weighted relation (⇒c1)k+1 as R, the set of initial
ton Aw and a regular set of configurations C, where Aw(C) = configurations S and a set of final configurations T, we want to
{Aw(c) | c ∈ C}. This allows one to solve for the meet- be able to solve for R(S,T) = ⊕{R(s,t) | s ∈ S,t ∈ T}.
Lover-all-pathsvalueMOP(S,T)forconfigurationsetsSandT,as This captures the net transformation on the data state between S
poststar(S)(T)=prestar(T)(S). and T:it isthecombine over the values of all paths involving at
We now provide some intuition into why one needs both for- most k context switches that go from a configuration in S to a
wardsandbackwardsautomata.ConsidertheautomatainFig.4(c). configuration in T. Our results from §5 and §6 allow us to solve
Forthepoststarautomaton, whenonefollowsapaththataccepts forthisvaluewhenSandT areregularsets.
theconfigurationhp,n8n4i,thetransition(p,n8,q)comesbefore Forexample, consider twocopiesoftheprograminFig.4(a)
(q,n4,acc).However,theformertransitiondescribesthetransfor- running in parallel. Let the control locations of the second copy
mation inside bar, which happens after the transformation per- beΓ′ = {n′,··· ,n′},todistinguishthemfromthoseofthefirst
1 8
formedinreachingthecallsiteatn4 (storedon(q,n4,acc)).Be- copy. Withk = 2,S = {hp,n1,n′1i}(thestartingconfiguration
causethetransformationforthecallingcontexthappensearlierin of the program), T = {hp,n6,u′i | u′ ∈ (Γ′)∗}(thread 1isat
theprogram, but itstransitionsappear later intheautomaton, the n6 andthread2canhaveanystack),andRasabove, theweight
weightsarereadbackwards.Fortheprestarautomaton,theweight R(S,T)wouldimplythatthevaluations(3,3),(3,7),(7,3),and
on(p,n4,acc)isthetransformationforgoingfromn4ton6(since (7,7)arepossible.
it is a backward analysis), which occurs after the transformation
insidebar.Thus,itisaforwardsautomaton. 5. WeightedTransducers
Thefollowinglemmastatesthecomplexityforsolvingpoststar
bythealgorithmofRepsetal.[40].WeusethenotationO (.)to Inthissection,weshowhowtoconstructaweightedtransducerfor
s
denotethetimeboundintermsofsemiringoperations. theweightedrelation⇒∗ofaWPDS.Wedeferthedefinitionofa
weightedtransducertoalittlelaterinthissection(Defn.12).
instead of one query for each p ∈ P and γ ∈ Γ. Because the
hp,γ1γ2γ3···γni ⇒∗ hp1,γ2γ3···γk+1γk+2···γni standardpoststaralgorithmbuildsanautomatonthatislargerthan
⇒∗ hp2,γ3···γk+1γk+2···γni theinputautomaton(Lemma2),A hasmanyfewerstatesthan
⇒∗ ··· grow
thoseinalltheA puttogether.
⇒∗ hpk,γk+1γk+2···γni Fig.7(b)and(pc,)γshowtheA andA automataforasimple
⇒∗ hpk+1,u1u2···uj γk+2···γni WPDSconstructedoverthemingproawthsemirpionpg(Defn.8).
The idea behind our approach is to use A to simulate the
pop
Figure6. ApathinthePDS’stransitionrelation;ui ∈Γ,j ≥1. firstphasewherethePDSpopsoffstacksymbols.Withreference
to Fig. 6, the transducer consumes γ1···γk from the input tape.
Whenthetransducer(non-deterministically)decidestoswitchover
Oursolutionisbasedonthefollowingobservationaboutpaths
in a PDS’s transition relation. Suppose that hp,γ1γ2···γni is a ttohethneexgtrsoywmthboplhianseth,eainndpuist,iintpsatastseespckoinntroAlptoopAwith γk+1tobestianrgt
configurationofaPDSP.Thenanypathinthetransitionrelation pk,γk+1
⇒∗describedbyP,startingfromthisconfiguration,canbewritten generatingtheoutputu1···uj.Thenitmovesintoanacceptphase
asshowninFig.6.Thefigureshowsthatthepathstartsinitiallyby whereitcopiestheuntouchedpartoftheinputstack(γk+2···γn)
totheoutput.
poppingoff somestacksymbols(ksymbolsinthefigure,k < n)
ThiscanbeoptimizedbyavoidingaseparatecopyofA for
in possibly multiple steps, after which it does not touch the rest p,γ
eachγ.LetA bethesameasA ,butwithfinalstatesrestricted
ofthestack(γk+1···γn),exceptforthetopsymbol (γk+1).Itis to {q | γ p∈ Γ}, and unreacghraowble states appropriately pruned
also possible for the path to pop off all stack symbols (k = n) p,γ
(see Fig. 7(d) and (e)). The transducer we construct will non-
andstopbecausenoPDSrulecanfireonanemptystack.Tomake
deterministicallyguessthestacksymbolγfromwhichthegrowth
thisobservationmoreformal,wedecomposeapathintophasesas
phasestarts,passcontroltoA ,andthenverifythattheguesswas
follows: p
correctwhenitreachesthefinalstateq inA .Asaresult,we
p,γ p
1. Pop-phase. The path pops off the top stack symbol without justneed|P|copiesofAgrow.
looking at the rest of the stack, i.e., it follows a sequence of NotethatApopisaforward-weightedautomaton,whereasAgrow
rulesthattakeshp,γuitohp′,ui,foranyu∈Γ∗. isabackward-weightedautomaton.Therefore,whenwemixthem
togethertobuildatransducer,wemustallowittoswitchdirections
forcomputingtheweightofapath.Thisseemsnecessary,because
2. Growth-phase.Thepathonlylooksatthetopofthestack,and
going back to Fig. 6, a PDS rule sequence consumes the input
possibly rewrites it, but does not pop it off, i.e., it follows a
configurationfromlefttoright(inthepopphase),butproducesthe
sequence of rules (possibly empty) that takes a configuration
outputstackconfigurationufromrighttoleft(asitpushessymbols
hp,γuitohp′,u′uiwithu′ ∈Γ+,foranyu∈Γ∗.
onthestack).Becauseweneedthetransducer tooutputu1···uj
EachpathinthePDS’stransitionrelationhaszeroormorepop- fromlefttoright,weneedtoswitchdirectionsforcomputingthe
phasesfollowedbyasingle(optional)growth-phase.Weconstruct weightofapath.Forthis,wedefinepartitionedtransducers.
the transducer for a WPDSby essentially pre-computing each of
DEFINITION12. Apartitionedweightedfinite-statetransducerτ
thesephases.First,wedefinetwoprocedures:
isatuple(Q,{Q }2 ,S,Σ ,Σ ,λ,I,F)whereQisafiniteset
i i=1 i o
1. pop:P ×Γ×P →Disdefinedasfollows: of states, {Q1,Q2} is a partition of Q, S = (D,⊕,⊗,0,1) is
pop(p,γ,p′)= {v(σ)|hp,γi⇒σ hp′,εi} abounded idempotent semiring, Σi and Σo are input and output
2. grow:P ×Γ→((P ×LΓ+)→D)isdefinedasfollows: arelplahtaiobne,tsI,λ⊆⊆QQ1×isDth×e(sΣetio∪f{iεn}it)i×al(sΣtaot∪es{,εa}n)d×FQ⊆istQhe2trisanthseitisoent
grow(p,γ)(p′,u)= {v(σ)|hp,γi⇒σ hp′,ui} offinalstates.Weimposearestrictiononthetransitionscrossing
L thestatepartition:if(q,w,a,b,q′)∈λandq∈Q,q′ ∈Q and
l k
Note that grow(p,γ) = post∗(hp,γi). The following Lem- l 6= k, thenl = 1,k = 2and w = 1. Givenastateq ∈ I,we
masgiveefficientalgorithmsforcomputingtheaboveprocedures. saythat the transducer can accept astring σ ∈ Σ∗ withoutput
i i
ProofsaregiveninApp.A. σ ∈ Σ∗ ifthereisapathfromstateq toafinal statethat takes
o o
inputσ andoutputsσ .
LEMMA3. LetA=(P,Γ,∅,P,P)beaP-automatonthatrepre- i o
Computingtheweightofapathrequiresmorecare.Forapath
sentsthesetofconfigurationsC = {hp,εi | p ∈ P}.LetA be
the forward weighted-automaton obtained by running prestpaorpon ηthatgoesthroughstatesq1,··· ,qm,suchthattheweightofthe
A. Then pop(p,γ,p′) isthe weight on the transition (p,γ,p′) in ith transition is wi, and all states qi are in Qj for some j, then
A .WecangenerateA intimeO (|P|2|∆|H),andithasat theweightofthispathv(η)isw1⊗w2⊗···⊗wmifj =1and
mopospt|P|states. pop s wm⊗wm−1⊗···⊗w1ifj =2,i.e.,thestatepartitiondetermines
thedirectioninwhichweperformextend.Forapathηthatcrosses
LEMMA4. LetAF = (Q,Γ,→,P,F)beaP-automaton,where partitions,i.e.,η=η1η2suchthateachηj isapathentirelyinside
Q = P ∪ {qp,γ | p ∈ P,γ ∈ Γ} and p −→γ qp,γ for each Qj,thenv(η)=v(η1)⊗v(η2).
p ∈ P,γ ∈ Γ.ThenA represents theconfiguration hp,γi.
{qp,γ} In this paper, we refer to partitioned weighted transducers as
LetAbethisautomatonwhereweleavethesetoffinalstatesun-
weightedtransducers,orsimplytransducerswhenthereisnopos-
defined. LetA bethebackward weighted-automaton obtained
grow
sibilityof confusion. Notethat whentheextend operator iscom-
from running poststar on A (it does not need to know the final
mutative,asinthecaseoftheBooleansemiringusedforencoding
states).If werestrict thefinal statesinA tobejust q (and
grow p,γ
PDSsasWPDSs,thepartitioningisunnecessary.
remove all states that do not have an accepting path to the fi-
LetSt(A)denotethesetofstatesofanautomatonA.Because
nal state), we obtain a backward weighted-automaton A =
p,γ
eachofA andA haveP asasubsetoftheirsetofstates,we
poststar(hp,γi) = grow(p,γ). We can compute A in time pop p
grow
distinguishthembyreferringtoastateq ∈ St(A )byq and
O (|P||∆|(|P||Γ|+|∆|)H),andithasatmost|P||Γ|+|∆|states. pop pop
s
q∈St(A )byq .
p p
TheadvantageoftheconstructionpresentedinLemma4isthat Given a WPDS W, we construct the desired weighted trans-
itjustrequiresasinglepoststarquerytocomputealloftheA , ducer τ using the steps given below. τ has states {q ,q }∪
p,γ W W i f
(a)
(c) (f)
hp ,ai֒→hp ,abi 1
1 1 b,1 eeeee/eee,0
hhpp12,,abii֒֒→→hhpp22,,bεii 11 (pd1)a,2 p2 AAAAp1 eeee/b,0 p1,b
(b) p1 b,a0,0 p1,b eeee/p1,0 pe1eee/a,0 eeeee/eeea/,b0,1 p1,a be/eee,0
a,0 b,1 p1,a eeee/b,1 ae/eee,0
b,0 p1,b b,1 eeee/p2,0 eeee/b,1e eeee/eee,2 eeee/b,1e eeee/eee,2 a/a, 0
p1 a,0 b,1e eee,2 b,1e eee,2 AAAApop be/eee,1 p2 eeeee/eee,0 b/b, 0
p,a
ba,,10 b,1 1b,1e eee ,2 (ep)2 qi p1e/eee,0 p1 ae/eee,2 p2 AAAAp2 eeee/a,0 p2,a ae/eee,0 qf
b,1pe eee ,2 a,0 p2,a p2 a,0 p2,a p2e/eee,0 eeee/p2,0 eeeee/peee2,0 eeeeeeeee//eebe,,10 p2,b be/eee,0
2
e beee ,,10 p2,b ebeee,,10 p2,b
Figure7. Weightedtransducerconstruction:(a)AsimpleWPDSwiththeminpathsemiring.(b)TheA automaton.Edgesarelabeled
grow
withtheirstacksymbolandweight.(c)TheA automaton.(d)TheA automatonobtainedfromA .(e)TheA automatonobtained
pop p1 grow p2
fromA .Theunnamedstatein(c)and(d)isanextrastateaddedbythepoststaralgorithmusedinLemma4.(f)Theweightedtransducer.
grow
Theboxesrepresent“copies”ofA ,A andA asrequiredbysteps2and3oftheconstruction.Thetransducerpathsthatacceptinput
pop p1 p2
(p1a)andoutput(p2bn),forn≥2,withweightnarehighlightedinbold.
Sbett(APpo∪p)Γ∪,(wSepig∈hPtSdto(mAapin)),thinepsuatmaelphaasbWet,Pin∪itiΓa,losutatpteutqa,lpahnad- gTiHveEnORinEpMut2(.pWuh)e,npth∈e trPa,nusdu∈ceΓr∗τ,Wth,eanstchoensctormucbtiendeaobvoevre,thies
i
final state qf. Its state partition is Q1 = {qi} ∪ St(Apop) and values of all paths in τW that output the string (p′ u′) is pre-
Qtai2ne=din{qQf1}s∪im(uSlapt∈esPtShet(pAopp)p)h.aTseh,eapnadrtthoefptahretctroanntsadinuecderincoQn2- cbiesecloynMstrOuPct(e{dhpin,utiim},e{Ohps′(,|uP′|i|}∆).|(M|Po|r|eΓo|v+er,|∆th|i)sHtr)a,nhsadsucaetrmcoasnt
simulatesthegrowthphase,includingthepartwheretheuntouched |P|2|Γ|+|P||∆|statesandatmost|P|2|∆|2transitions.
partofthestackiscopiedtotheoutputtape.Transitionstoτ are
W UsuallytheWPDSsusedformodelingprogramshave|P|=1
addedasfollows(anexampleisgiveninFig.7):
and|Γ| < |∆|.Inthatcase,constructingatransducerhassimilar
complexityandsizeasrunningasinglepoststarquery.Aproofof
1. For each state p ∈ P, add the transition (q ,p/ε,p ) with
i pop Thm.2isgiveninApp.A.
weight1toτ .
W
2. Foreachtransition(p1pop,γ,p2pop)withweightwinApopaddthe 6. ComposingWeightedTransducers
transition(p1 ,(γ/ε),p2 )withthesameweighttoτ ,i.e.,
pop pop W Compositionofunweightedtransducersisstraightforward,butthis
copyoverA .
pop is not the case with weighted transducers. The requirement here
3. Foreachtransition(qp,γ′,qp′)ineachautomaton Ap addthe istotaketwoweightedtransducersandcreateanotheronewhose
transition (qp,(ε/γ′),qp′) with the same weight to τW, i.e., (weighted)languageisarelationalcompositionofthe(weighted)
copyovereachoftheAp. language of the two transducers (see Lemma 1 and Defn. 9). In
4. For each q,q′ ∈ P, add the transition (q ,(ε/q′),q′) with particular,thecompositionistobeperformedbyextend(⊗)which
pop p istherequirementthatpresentsdifficulties.
weight1toτ .Thistransitionpermitsaswitchfromthepop
W We begin with a slightly simpler problem on weighted au-
phasetothegrowthphase.Atthispoint,wejustknowthatthe
tomata. The machinery that we develop for this problem will be
growth phase begins instate q and ends instate q′. Thisstep
usedforcomposingweightedtransducers.
guessesthestacksymbol fromwhichthegrowthphasestarts.
Thenextstepverifiesthatourguesswascorrect.
6.1 TheSequentialProductofTwoWeightedAutomata
5. For each final state q ∈ St(A ), add the transition
p,γ p Given forward-weighted automata A1 and A2, we wish to con-
(q ,(γ/ε),q )withweight 1toτ .Thistransitionverifies
p,γ f W structanotherweightedautomatonA3suchthatforanyconfigura-
thatγwasontheinputtape,andwejustcompletedthegrowth
tionc,A3(c)=A1(c)⊗A2(c).Assumethatconfigurationsconsist
phasestartingfromγ.
ofjustthestack(and|P|=1,whichfixesthestartingstatesofthe
6. For each p,q ∈ P, add the transition (q ,(ε/ε),q ) with automata).Thisisaspecialcaseoftransducercomposition:when
p f
weight 1 to τ . This transition allows us to skip the growth atransduceronlyhastransitionsoftheform(γ/γ),itisessentially
W
phasebygoingdirectlytothefinalstate. anautomaton,andcompositionofsuchtransducersreducestothe
aboveproblem.FortheBooleanweightdomain,thisreducestoun-
7. Foreachγ ∈Γ,addthetransition(q ,(γ/γ),q )withweight
f f weightedautomatonintersection(withwordsacceptedwithweight
1toτ .Thispartofthetransducercopiesovertheuntouched
W 0beingconsideredaswordsnotacceptedbytheautomaton).
partoftheinputtapetotheoutputtape.
Because the extend operation intuitively corresponds to con-
catenationofpaths,afirstattemptatsolvingthisproblemistocon-