Systematic design of program analysis frameworks

• Authors: Patrick Cousot;Radhia Cousot
• Venue: POPL '79 Proceedings of the 6th ACM SIGACT-SIGPLAN symposium on Principles of programming languages
• Year: 1979

Semantic analysis of programs is essential in optimizingcompilers and program verification systems. It encompasses dataflow analysis, data type determination, generation of approximateinvariant assertions, etc.Several recent papers (among others Cousot & Cousot[77a],Graham & Wegman[76], Kam & Ullman[76], Kildall[73],Rosen[78], Tarjan[76], Wegbreit[75]) have introduced abstractapproaches to program analysis which are tantamount to the use of aprogram analysis framework (A,t,ã) where A is alattice of (approximate) assertions, t is an (approximate)predicate transformer and ã is an often implicit functionspecifying the meaning of the elements of A. This paper is devotedto the systematic and correct design of program analysis frameworkswith respect to a formal semantics.Preliminary definitions are given in Section 2 concerning themerge over all paths and (least) fixpoint program-wide analysismethods. In Section 3 we briefly define the (forward and backward)deductive semantics of programs which is later used as a formalbasis in order to prove the correctness of the approximate programanalysis frameworks. Section 4 very shortly recall the mainelements of the lattice theoretic approach to approximate semanticanalysis of programs.The design of a space of approximate assertions A is studied inSection 5. We first justify the very reasonable assumption that Amust be chosen such that the exact invariant assertions of anyprogram must have an upper approximation in A and that theapproximate analysis of any program must be performed using adeterministic process. These assumptions are shown to imply that Ais a Moore family, that the approximation operator (wich definesthe least upper approximation of any assertion) is an upper closureoperator and that A is necessarily a complete lattice. We next showthat the connection between a space of approximate assertions and acomputer representation is naturally made using a pair of isotoneadjoined functions. This type of connection between two completelattices is related to Galois connections thus making availableclassical mathematical results. Additional results are proved, theyhold when no two approximate assertions have the same meaning.In Section 6 we study and examplify various methods which can beused in order to define a space of approximate assertions orequivalently an approximation function. They include thecharacterization of the least Moore family containing an arbitraryset of assertions, the construction of the least closure operatorgreater than or equal to an arbitrary approximation function, thedefinition of closure operators by composition, the definition of aspace of approximate assertions by means of a complete joincongruence relation or by means of a family of principalideals.Section 7 is dedicated to the design of the approximatepredicate transformer induced by a space of approximate assertions.First we look for a reasonable definition of the correctness ofapproximate predicate transformers and show that a localcorrectness condition can be given which has to be verified forevery type of elementary statement. This local correctnesscondition ensures that the (merge over all paths or fixpoint)global analysis of any program is correct. Since isotony is notrequired for approximate predicate transformers to be correct it isshown that non-isotone program analysis frameworks are manageablealthough it is later argued that the isotony hypothesis is natural.We next show that among all possible approximate predicatetransformers which can be used with a given space of approximateassertions there exists a best one which provides the maximuminformation relative to a program-wide analysis method. The bestapproximate predicate transformer induced by a space of approximateassertions turns out to be isotone. Some interesting consequencesof the existence of a best predicate transformer are examined. Oneis that we have in hand a formal specification of the programswhich have to be written in order to implement a program analysisframework once a representation of the space of approximateassertions has been chosen. Examples are given, including oneswhere the semantics of programs is formalized using Hoare[78]'ssets of traces.In Section 8 we show that a hierarchy of approximate analysescan be defined according to the fineness of the approximationsspecified by a program analysis framework. Some elements of thehierarchy are shortly exhibited and related to the relevantliterature.In Section 9 we consider global program analysis methods. Thedistinction between "distributive" and "non-distributive" programanalysis frameworks is studied. It is shown that when the bestapproximate predicate transformer is considered the coincidence ornot of the merge over all paths and least fixpoint global analysesof programs is a consequence of the choice of the space ofapproximate assertions. It is shown that the space of approximateassertions can always be refined so that the merge over all pathsanalysis of a program can be defined by means of a least fixpointof isotone equations.Section 10 is devoted to the combination of program analysisframeworks. We study and examplify how to perform the "sum","product" and "power" of program analysis frameworks. It is shownthat combined analyses lead to more accurate information than theconjunction of the corresponding separate analyses but this canonly be achieved by a new design of the approximate predicatetransformer induced by the combined program analysisframeworks.