Predicate Abstraction and Canonical Abstraction for Singly-Linked Lists
Predicate abstraction and canonical abstraction are two finitary abstractions used to prove properties of programs. We study the relationship between these two abstractions by considering a very limited case: abstraction of (potentially cyclic) singly-linked lists.
We provide a new and rather precise family of abstractions for potentially cyclic singly-linked lists. The main observation behind this family of abstractions is that the number of shared nodes in linked lists can be statically bounded. Therefore, the number of possible “heap shapes” is also bounded. We present the new abstraction in both predicate abstraction form as well as in canonical abstraction form.
As we illustrate in the paper, given any canonical abstraction, it is possible to define a predicate abstraction that is equivalent to the canonical abstraction. However, with this straightforward simulation, the number of predicates used for the predicate abstraction is exponential in the number of predicates used by the canonical abstraction.
An important feature of the family of abstractions we present in this paper is that the predicate abstraction representation we define is far more practical as it uses a number of predicates that is quadratic in the number of predicates used by the corresponding canonical abstraction representation. In particular, for the most abstract abstraction in this family, the number of predicates used by the canonical abstraction is linear in the number of program variables, while the number of predicates used by the predicate abstraction is quadratic in the number of program variables.
We have encoded this particular predicate abstraction and corresponding transformers in TVLA, and used this implementation to successfully verify safety properties of several list manipulating programs, including programs that were not previously verified using predicate abstraction or canonical abstraction.
KeywordsAbstract State Auxiliary Variable Program Variable Concrete State Unary Predicate
Unable to display preview. Download preview PDF.
- 1.Ball, T., Majumdar, R., Millstein, T., Rajamani, S.: Automatic predicate abstraction of C programs. In: Proc. Conf. on Prog. Lang. Design and Impl., pp. 203–213 (June 2001)Google Scholar
- 2.Ball, T., Rajamani, S.: Generating abstract explanations of spurious counterexamples in c programs. Report MSR-TR-2002-09, Microsoft Research, Microsoft Redmond (January 2002), http://research.microsoft.com/slam/
- 3.Benedikt, M., Reps, T., Sagiv, M.: A decidable logic for describing linked data structures. In: Proceedings of the 1999 European Symposium On Programming, pp. 2–19 (March 1999)Google Scholar
- 4.Blanchet, B., Cousot, P., Cousot, R., Feret, J., Mauborgne, L., Mine, M., Monniaux, D., Rival, X.: A static analyzer for large safety-critical software. In: Fenwick, J.J.B., Norris, C. (eds.) Proceedings of the ACM SIGPLAN 2003 Conference on Programming Language Design and Implementation (PLDI 2003), June 9–11. ACMSIGPLAN Notices, vol. 38(5), pp. 196–207. ACM Press, New York (2003)CrossRefGoogle Scholar
- 7.Cousot, P., Cousot, R.: Systematic design of program analysis frameworks. In: Proc. Symp. on Principles of Prog. Languages, pp. 269–282. ACM Press, New York (1979)Google Scholar
- 9.Deutsch, A.: Interprocedural may-alias analysis for pointers: Beyond k-limiting. In: Proc. Conf. on Prog. Lang. Design and Impl., pp. 230–241. ACM Press, New York (1994)Google Scholar
- 10.Gopan, D., DiMaio, F., Dor, N., Reps, T., Sagiv, M.: Numeric domains with summarized dimensions. In: Tools and Algs. for the Construct. and Anal. of Syst., pp. 512–529 (2004)Google Scholar
- 11.Graf, S., Saidi, H.: Construction of abstract state graphs with PVS. In: Grumberg, O. (ed.) CAV 1997. LNCS, vol. 1254, pp. 72–83. Springer, Heidelberg (1997)Google Scholar
- 12.Henzinger, T., Jhala, R., Majumdar, R., Sutre, G.: Lazy abstraction. In: Symposium on Principles of Programming Languages, pp. 58–70 (2002)Google Scholar
- 13.Immerman, N., Rabinovich, A., Reps, T., Sagiv, M., Yorsh, G.: The boundary between decidability and undecidability for transitive closure logics. In: Proc. Computer Science Logic (2004) (to appear)Google Scholar
- 15.Jensen, J., Joergensen, M., Klarlund, N., Schwartzbach, M.: Automatic verification of pointer programs using monadic second-order logic. In: Proc. Conf. on Prog. Lang. Design and Impl. (1997)Google Scholar
- 16.Jones, N., Muchnick, S.: Flow analysis and optimization of Lisp-like structures. In: Muchnick, S., Jones, N. (eds.) Program Flow Analysis: Theory and Applications, ch. 4, pp. 102–131. Prentice-Hall, Englewood Cliffs (1981)Google Scholar
- 18.Manevich, R., Yahav, E., Ramalingam, G., Sagiv, M.: Predicate abstraction and canonical abstraction for singly-linked lists. Technical Report TR-2005-01-191212, Tel Aviv University (2005)Google Scholar
- 19.Microsoft Research. The SLAM project (2001), http://research.microsoft.com/slam/
- 21.Ramalingam, G., Warshavsky, A., Field, J., Goyal, D., Sagiv, M.: Deriving specialized program analyses for certifying component-client conformance. In: Proc. Conf. on Prog. Lang. Design and Impl., vol. 37(5), pp. 83–94 (June 2002)Google Scholar