A logic for locally complete abstract interpretations

R Bruni, R Giacobazzi, R Gori… - 2021 36th Annual ACM …, 2021 - ieeexplore.ieee.org
2021 36th Annual ACM/IEEE Symposium on Logic in Computer Science …, 2021ieeexplore.ieee.org
We introduce the notion of local completeness in abstract interpretation and define a logic
for proving both the correctness and incorrectness of some program specification. Abstract
interpretation is extensively used to design sound-by-construction program analyses that
over-approximate program behaviours. Completeness of an abstract interpretation A for all
possible programs and inputs would be an ideal situation for verifying correctness
specifications, because the analysis can be done compositionally and no false alert will …
We introduce the notion of local completeness in abstract interpretation and define a logic for proving both the correctness and incorrectness of some program specification. Abstract interpretation is extensively used to design sound-by-construction program analyses that over-approximate program behaviours. Completeness of an abstract interpretation A for all possible programs and inputs would be an ideal situation for verifying correctness specifications, because the analysis can be done compositionally and no false alert will arise. Our first result shows that the class of programs whose abstract analysis on A is complete for all inputs has a severely limited expressiveness. A novel notion of local completeness weakens the above requirements by considering only some specific, rather than all, program inputs and thus finds wider applicability. In fact, our main contribution is the design of a proof system, parameterized by an abstraction A, that, for the first time, combines over- and under-approximations of program behaviours. Thanks to local completeness, in a provable triple ⊢A [P ] c [Q], the assertion Q is an under-approximation of the strongest post-condition post[c](P ) such that the abstractions in A of Q and post[c](P ) coincide. This means that Q is never too coarse, namely, under mild assumptions, the abstract interpretation of c does not yield false alerts for the input P iff Q has no alert. Thus, ⊢ A [P ] c [Q] not only ensures that all the alerts raised in Q are true ones, but also that if Q does not raise alerts then c is correct.
ieeexplore.ieee.org
以上显示的是最相近的搜索结果。 查看全部搜索结果