Lattice based Least Fixed Point Logic

Nowadays, we heavily rely on software systems. At the same time they become bigger and more complex, and hence the number of potential errors increases. In order to achieve more reliable systems, formal verification techniques may be applied. A widely used verification technique is static analysis, which reasons about system behavior without executing it. It is performed statically at compile-time, and it computes safe approximations of values or behaviors that may occur at run-time. Static analysis is increasingly recognized as a fundamental technique for program verification, bug detection, compiler optimization and software understanding.

Unfortunately, developing new static analyses is difficult and error-prone. In order to overcome that problem it is desirable to implement prototypes of analyses that are easy to analyse for complexity and correctness. Since analysis specifications are generally written in a declarative style, logic programming presents an attractive model for producing executable specifications of analyses. Furthermore, thanks to the advances in logic programming, the associated solvers became more efficient.

In this paper we present a framework that facilitates rapid prototyping of new static analyses. The approach taken falls within the Abstract Interpretation [8, 7] framework, thus there always is a unique best solution to the analysis problem considered. The framework consists of the Lattice based Least Fixed Point Logic (LLFP) and the associated solver. The most prominent feature of the LLFP logic is its interpretation over complete lattices satisfying the Ascending Chain Condition, which makes it possible to express sophisticated analyses in LLFP. The solver combines a continuation passing style algorithm with propagation of differences, and uses prefix trees as its main data structure. The applicability of the framework is illustrated by presenting a specification of interval analysis, which could not be specified using logics traditionally used such as Datalog [1, 5] or ALFP [18].

This paper is organized as follows. In Section 2 we present the problem we want to solve and indicate a solution. Section 3 introduces syntax and semantics of the LLFP logic. In Section 4 we establish our main theoretical contribution; namely a Moore Family result for LLFP. Section 5 describes the solving algorithm for LLFP. We conclude and discuss future work in Section 6.

There is an immense body of work on using logic for specifying static analyses. However, logics traditionally used have some limitations. To illustrate the problem, let us briefly introduce the Alternation free Least Fixed Point Logic (ALFP) and then try to devise the ALFP specifications of two analyses: detection of signs and interval analysis.

In the previous section we briefly introduced ALFP logic, which is interpreted over a finite universe of atoms; in this section we present an extension of ALFP called LLFP allowing interpretations over complete lattices satisfying Ascending Chain Condition. We also allow function terms as arguments of relations. Since functions over the universe $\mathcal{U}$ can be represented as relations, we do not consider them here. Instead, we focus on functions over a complete lattice $\llbracket f\rrbracket:\mathcal{L}^{k}\rightarrow\mathcal{L}$, and we restrict our attention to monotone functions only. Recall that a function $\llbracket f\rrbracket:\mathcal{L}_{1}\rightarrow\mathcal{L}_{2}$ between partially ordered sets $\mathcal{L}_{1}=(\mathcal{L}_{1},\sqsubseteq_{1})$ and $\mathcal{L}_{2}=(\mathcal{L}_{2},\sqsubseteq_{2})$ is monotone if

Let us begin with introducing necessary definitions.

A subset $Y\subseteq\mathcal{L}$ of a partially ordered set $\mathcal{L}=(\mathcal{L},\sqsubseteq)$ is a chain if

Hence, a chain is a (possibly empty) subset of $\mathcal{L}$ that is totally ordered. A sequence $(l_{n})_{n}$ of elements in $\mathcal{L}$ is an ascending chain if

We say that a sequence $(l_{n})_{n}$ eventually stabilises if and only if

The partially ordered set $\mathcal{L}$ satisfies Ascending Chain Condition if and only if all ascending chains eventually stabilise. Essentially, the Ascending Chain Condition guarantees that the least fixed point computation always terminates. Due to the use of negation in the logic, we need to introduce a complement operator, $\complement$, in the underlying complete lattice. The only condition that we impose on the complement is anti-monotonicity i.e. $\forall l_{1},l_{2}\in\mathcal{L}:l_{1}\sqsubseteq l_{2}\Rightarrow\complement l_{1}\sqsupseteq\complement l_{2}$, which is necessary for establishing Moore Family result. The following definition introduces the syntax of LLFP.

We write $\mathit{fv}(\cdot)$ for the set of free variables in the argument $\cdot$. Occurrences of $R(\vec{u};V)$ and $\neg R(\vec{u};V)$ in preconditions are called positive, resp. negative, queries and we require that $\mathit{fv}(\vec{u})\subseteq{\cal X}$ and $\mathit{fv}(V)\subseteq{\cal Y}\cup{\cal X}$; these variables are defining occurrences. Occurrences of $Y(u)$ in preconditions must satisfy $Y\in{\cal Y}$ and $\mathit{fv}(u)\subseteq{\cal X}$; $Y$ is an applied occurrence, $u$ is a defining occurrence. Clauses of the form $R(\vec{u};V^{\prime})$ are called assertions; we require that $\mathit{fv}(\vec{u})\subseteq{\cal X}$ and $\mathit{fv}(V^{\prime})\subseteq{\cal Y}\cup{\cal X}$ and we note that these variables are applied occurrences. A clause $cl$ satisfying these conditions together with $\mathit{fv}(cl)=\emptyset$ is said to be well-formed; we are only interested in clause sequences $cls$ consisting of well-formed clauses.

In order to ensure desirable theoretical and pragmatic properties in the presence of negation, we impose a notion of stratification similar to the one in Datalog [1, 5]. Intuitively, stratification ensures that a negative query is not performed until the predicate has been fully asserted. This is important for ensuring that once a precondition evaluates to true it will continue to be true even after further assertions of predicates.

The following example illustrates the use of negation in the LLFP formula.

To specify the semantics of LLFP we introduce the interpretations $\varrho$, $\varsigma$ and $\zeta$ of predicate symbols, variables and function symbols, respectively. Formally we have

In the above $\mathcal{R}_{/k}$ stands for a set of predicate symbols of arity $k$, and $\mathcal{R}$ is a disjoint union of $\mathcal{R}_{/k}$, hence $\mathcal{R}=\biguplus_{k}\mathcal{R}_{/k}$. Similarly, $\mathcal{F}_{/k}$ is a set of function symbols of arity $k$ over the complete lattice $\mathcal{L}$. The set $\mathcal{F}$ is then defined as disjoint unions of $\mathcal{F}_{/k}$; hence $\mathcal{F}=\biguplus_{k}\mathcal{F}_{/k}$. The interpretation of variables from $\mathcal{X}$ is given by $\llbracket x\rrbracket(\zeta,\varsigma)=\varsigma(x)$, where $\varsigma(x)$ is the element from $\mathcal{U}$ bound to $x\in{\cal X}$. Analogously, the interpretation of variables from $\mathcal{Y}$ is given by $\llbracket Y\rrbracket(\zeta,\varsigma)=\varsigma(Y)$, where $\varsigma(Y)$ is the element from $\mathcal{L}_{\neq\bot}=\mathcal{L}\setminus\{\bot\}$ bound to $Y\in\mathcal{Y}$. We do not allow variables from $\mathcal{Y}$ to be mapped to $\bot$ in order to establish a relationship between ALFP and LLFP in the case of powerset lattice, i.e. $\mathcal{P}(\mathcal{U})$, which we briefly describe later. In order to give the interpretation of $[u]$, we introduce a function $\beta:\mathcal{U}\rightarrow\mathcal{L}$. The $\beta$ function is called a representation function and the idea is that $\beta$ maps a value from the universe $\mathcal{U}$ to the best property describing it. For example in the case of a powerset lattice, $\beta$ could be defined by $\beta(a)=\{a\}$ for all $a\in\mathcal{U}$. Then the interpretation is given by $\llbracket[u]\rrbracket(\zeta,\varsigma)=\beta(\llbracket u\rrbracket(\zeta,\varsigma))$. The interpretation of function terms is defined as $\llbracket f(\vec{V}^{\prime})\rrbracket(\zeta,\varsigma)=\zeta(f)(\llbracket\vec{V}^{\prime}\rrbracket(\zeta,\varsigma))$. For the functions we require that $\zeta(f):\mathcal{L}^{k}\rightarrow\mathcal{L}$ is monotone. The interpretation of terms is generalized to sequences $\vec{u}$ of terms in a point-wise manner by taking $\llbracket a\rrbracket(\zeta,\varsigma)=a$ for all $a\in{\cal U}$, thus $\llbracket(u_{1},\ldots,u_{k})\rrbracket(\zeta,\varsigma)=(\llbracket u_{1}\rrbracket(\zeta,\varsigma),\ldots,\llbracket u_{k}\rrbracket(\zeta,\varsigma))$. The interpretation of lattice terms $V$ (and $V^{\prime}$) is generalized to sequences $\vec{V}$ (and $\vec{V^{\prime}}$) of lattice terms in the similar way.

The satisfaction relations for preconditions $pre$, clauses $cl$ and clause sequences $cls$ are specified by:

The formal definition is given in Table 1; here $\varsigma[x\mapsto a]$ stands for the mapping that is as $\varsigma$ except that $x$ is mapped to $a$ and similarly $\varsigma[Y\mapsto l]$ stands for the mapping that is as $\varsigma$ except that $Y$ is mapped to $l\in\mathcal{L}_{\neq\bot}$.

In this section we establish a Moore family result for LLFP that guarantees that there always is a unique best solution for LLFP clauses.

It follows that a Moore family always contains a least element, $\bigsqcap Y$, and a greatest element, $\bigsqcap\emptyset$, which equals the greatest element, $\top$, from $\mathcal{L}$; in particular, a Moore family is never empty. The property is also called the model intersection property, since whenever we take a meet of a number of models we still get a model.

Assume $cls$ has the form $cl_{1},\ldots,cl_{s}$, and let $\Delta=\{\varrho:\prod_{k}\mathcal{R}_{/k}\rightarrow\mathcal{U}^{k}\rightarrow\mathcal{L}\}$ denote the set of interpretations $\varrho$ of predicate symbols in $\mathcal{R}$. We also define the lexicographical ordering $\preceq$ such that $\varrho_{1}\preceq\varrho_{2}$ if and only if there is some $1\leq j\leq s$. where $s$ is the order of the formula, such that the following properties hold:

1. (a)

   $\varrho_{1}(R)=\varrho_{2}(R)$ for all $R\in\mathcal{R}$ with $\mbox{\rm rank}(R)<j$,

2. (b)

   $\varrho_{1}(R)\sqsubseteq\varrho_{2}(R)$ for all $R\in\mathcal{R}$ with $\mbox{\rm rank}(R)=j$,

3. (c)

   either $j=s$ or $\varrho_{1}(R)\sqsubset\varrho_{2}(R)$ for at least one $R\in\mathcal{R}$ with $\mbox{\rm rank}(R)=j$.

We say that $\varrho_{1}(R)\sqsubseteq\varrho_{2}(R)$ if and only if $\forall\vec{a}\in\mathcal{U}^{k}:\varrho_{1}(R)(\vec{a})\sqsubseteq\varrho_{2}(R)(\vec{a})$, where $k\geq 0$ is the arity of $R$. Notice that in the case $s=1$, the above ordering coincides with lattice ordering $\sqsubseteq$. Intuitively, the lexicographical ordering $\preceq$ orders the relations strata by strata starting with the strata $0$. It is essentially analogous to the lexicographical ordering on strings, which is based on the alphabetical order of their characters.

Assume $cls$ has the form $cl_{1},\cdots,cl_{s}$ where $cl_{j}$ is the clause corresponding to stratum $j$, and let $\mathcal{R}_{j}$ denote the set of all relation symbols $R$ defined in $cl_{1},\cdots,cl_{j}$ taking $\mathcal{R}_{0}=\emptyset$. Let $M\subseteq\Delta$ denote a set of assignments which map relation symbols to relations.

Note that $\bigsqcap{\!}_{\Delta}M$ is well defined by induction on $j$ observing that $M_{0}=M$ and $M_{j}\subseteq M_{j-1}$.

The result ensures that the approach falls within the framework of Abstract Interpretation [7, 8]; hence we can be sure that there always is a single best solution for the analysis problem under consideration, namely the one defined in Proposition 1.

In this section we present the algorithm for solving LLFP clause sequences, which extends the differential worklist algorithm by Nielson et al. [18, 17]. The algorithm computes the relations in increasing order on their rank and therefore the negations present no obstacles. It completely abandons a worklist-like data structures, which are typical for most classical iterative fixpoint algorithms [12]. Instead, we adapt the recursive topdown approach of Le Charlier and van Hentenryck [6] which is enhanced by continuation based semi-naive iteration [3, 11].

In the following we assume that prior to solving the LLFP formula, all the clauses are transformed into a form such that all applied occurrences of variables $Y\in\mathcal{Y}$ in preconditions, i.e. $Y(u)$, are not followed by their defining occurrences, i.e. $R(\vec{u};Y)$ and $\neg R(\vec{u};Y)$. This is necessary to correctly perform late bindings of variables $Y\in\mathcal{Y}$ in the presence of $Y(u)$ construct.

The algorithm operates with (intermediate) representations of the two interpretations $\varsigma$ and $\varrho$ of the semantics; we shall call them env and result, respectively, in the following. The data structure env is supplied as a parameter to the functions of the algorithms, and it represents partial environment. The data structure result is an imperative data structure that is updated as we progress.

The partial environment env is implemented as a map from variables to their optional values. In the case the variable is undefined it is mapped into $\mathit{None}$. Otherwise, depending on its type it is mapped to $\mathit{Some}(a)$ or $\mathit{Some}(l)$, which means that the variable is bound to $a\in{\cal U}$, or $l\in\mathcal{L}_{\neq\bot}$, respectively. The main operation on env is the function unify, defined as follows

It uses two auxiliary functions that perform unifications on each component of the relation. For the first component, which ranges over the universe $\mathcal{U}$, the function is given by

It performs a unification of an argument $u$ with an element $a\in\mathcal{U}$ in the environment env. In the case when the unification succeeds the modified environment is returned, otherwise the function fails. The funcion is extended to $k$-tuples in a straightforward way. The definition of the unification function for the lattice component is given by

The function is parametrized with $\beta:\mathcal{U}\rightarrow\mathcal{L}$, defined in Section 3. It performs a unification of an lattice term $V$ with an element $l\in\mathcal{L}$ in the environment env. In the case when the unification succeeds the set of unified environments is returned, otherwise the function returns empty set.

The other important operation on the partial environment is given by the function unifiable. The function when applied to env and a tuple $(\vec{u};V)$, returns a set of tuples for which unify would succeed. The function is defined by means of two auxiliary functions, formally we have

where

and

Both auxiliary funcions are extended to $k$-tuples in a straightforward way.

The global data structure result, which is updated incrementally during computations, is represented as a mapping from predicate names to the prefix trees that for each predicate $R$ record the tuples currently known to belong to $R$. There are three main operations on the data structure result: the operation result.has checks whether a given tuple is associated with a given predicate, the operation result.sub returns a list of the tuples associated with a given predicate and the operation result.add adds a tuple to the interpretation of a given predicate.

Since $\varrho$ is updated as the algorithm progresses, it may happen that a query $R(\vec{v};V)$ inside a precondition fails to be satisfied at the given point in time, but may hold in the future when a new tuple $(\vec{a};l)$ is added to the interpretation of $R$. If we are not careful we may lose the consequences that adding $(\vec{a};l)$ to $R$ will have on the contents of other predicates. This gives rise to the data structure infl that records computations that have to be resumed for the new tuples; these future computations are called consumers. The infl data structure is also represented as a mapping from the predicate names to prefix trees that for each predicate $R$ record consumers that have to be resumed when the interpretation of $R$ is updated. There are two main operations on the data structure infl: the operation infl.register that adds a new consumer for a given predicate and infl.consumers that returns all the consumers currently associated with a given predicate.

In the algorithm, we have one function for each of the three syntactic categories. The function solve takes a clause sequence as input and calls the function execute on each of the individual clauses

where we write [ ] for the empty environment reflecting that we have no free variables in the clause sequences.

Let us now turn to the description of the function execute. The function takes a clause $cl$ as a parameter and a representation env of the interpretation of the variables. We have one case for each of the forms of $cl$; the pseudo code is given in Figure 1.

Let us explain the case of an assertion first. The algorithm uses the auxiliary function iter, which applies the function iterFun to each element of the list of tuples that can be unified with the argument $(\vec{v};V)$. Given a tuple $(\vec{a};l)$, the function iterFun adds the tuple to the interpretation of $R$ stored in result if it is not already present. If the add operation succeeds, we first create a list of all the consumers currently registered for predicate $R$ by calling the function infl.consumers. Thereafter, we resume the computations by iterating over the list of consumers and calling corresponding continuations. The cases of always true clause, 1, is straightforward; the function simply returns the unit, without performing any other actions. In the case of the conjunction of clauses the algorithm calls the execute function for both conjuncts and the current environment env. In the case of implication we make use of the function check that in addition to the precondition and the environment also takes the continuation $\textsc{execute}(cl)$ as an argument. In the case of universal quantification, we simply extend the environment to record that the value of the new variable is unknown and then we recurse. The case of universal quantification over a variable $Y\in\mathcal{Y}$ is exactly the same and hence omitted.

Now, let us present the function check. It takes a precondition, a continuation and an environment as parameters. The pseudo code is given in Figure 2.

In the case of positive queries we first ensure that the consumer is registered in infl, by calling function register, so that future tuples associated with $R$ will be processed. Thereafter, the function inspects the data structure result to obtain the list of tuples associated with the predicate $R$. Then, the auxiliary function consumer unifies $(\vec{v};V)$ with each tuple; and if the operation succeeds, the continuation $next$ is invoked on each of the updated new environments in the returned set envs. In the case of negated query, the algorithm first computes the tuples unifiable with $(\vec{v};V)$ in the environment env. Then, for each tuple it checks whether the tuple is already in $R$ and if not, the tuple is unified with $(\vec{v};V)$ to produce set of new environments. Thereafter, the continuation $next$ is evaluated in each of the environments contained in the returned set. Notice that in the case of negative queries we do not register a consumer for the relation $R$. This is because the stratification condition introduced in Definition 3 ensures that the relation is fully evaluated before it is queried negatively. Thus, there is no need to register future computations since the interpretation of $R$ will not change. Now, let us consider function check in the case of $Y(x)$, where $x\in\mathcal{X}$. The function begins with creating an environment env’ that is exactly as env except that the binding for the variable $Y$ is set to $\top$ in the case $Y$ is undefined in env. Then, we define an auxiliary function that checks whether env’$(Y)$ over-approximates the abstraction of an argument $a$, denoted by $\beta(a)$, and if so the continuation is called in the environment env’$[x\mapsto a]$. Finally, the function checks the binding for the variable $x$ in the environment env’ and if it is bound to $\mathit{Some}(a)$ the function f applied to $a$ is called. Otherwise, the function f is called for each element of the universe, using the iter function. The case of $Y(a)$, where $a\in\mathcal{U}$ is essentially the same as the case explained above, except that we do not have to handle the case when $x\in\mathcal{X}$ is undefined in env. For conjunction of preconditions we exploit a continuation passing programming style. More precisely, we call the check function for the precondition $pre_{1}$, and as a continuation we pass a call to the check function partially applied to the precondition $pre_{2}$ and the continuation $next$. In the case of disjunction of preconditions the function simply checks preconditions $pre_{1}$ and $pre_{2}$ respectively in the current environment env. In order to be efficient we use memoization; this means that if both checks yield the same bindings of variables, the second check does not need to consider the continuation, as it has already been done. The algorithm for existential quantification checks the precondition $pre$ in the environment extended with the quantified variable. The continuation that is passed is a composition of functions $next$ and remove $x$, where the function remove removes variable passed as a first argument from the environment passed as a second argument. In order to be efficient we again use a memoization to avoid redundant computations. The case of existential quantification over a variable $Y\in\mathcal{Y}$ is exactly the same and hence omitted.