As usual in computability and complexity, our comparison between verification and analysis is made through a many-one reduction, namely by reducing a verification problem into an analysis problem and vice versa. The minimal requirement is that these reduction functions are total recursive. Moreover, we require that the reduction function does not depend upon a fixed abstract domain. This allows us to be problem agnostic and to prove a reduction for all possible verifiers and analysers. Program verification and analysis are therefore equivalent problems whenever we can reduce one to the other. In the following, we prove that while it is always possible to transform a program analyser into an equivalent program verifier, the converse does not hold in general, but it can always be done for finite abstract domains.
7.1 Reducing Verification to Analysis
Theorem 7.1
Let \(\langle A,\gamma ,\le _\gamma \rangle \) be any given abstract domain. There exists a transform \(\sigma : {{\mathrm{\mathbb {A}}}}_A \rightarrow {{\mathrm{\mathbb {V}}}}_{\!A}\) such that:
- (1):
-
\(\sigma \) is a total recursive function such that for all \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_A\), \(\sigma ({{\mathrm{\mathcal {A}}}}) \cong {{\mathrm{\mathcal {A}}}}\);
- (2):
-
if \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_A\) is sound then \(\sigma ({{\mathrm{\mathcal {A}}}})\) is sound;
- (3):
-
\(\sigma \) is monotonic;
- (4):
-
\(\sigma ({{\mathrm{\mathcal {A}}}}) \cong \sigma ({{\mathrm{\mathcal {A}}}}') \Rightarrow {{\mathrm{\mathcal {A}}}}\cong {{\mathrm{\mathcal {A}}}}'\).
Proof
Given \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_A\), we define \(\sigma ({{\mathrm{\mathcal {A}}}}): {{\mathrm{Prog}}}\times A \rightarrow \{\mathbf {t},\mathbf ? \}\) as follows:
$$ \sigma ({{\mathrm{\mathcal {A}}}})(P,a) \triangleq {\left\{ \begin{array}{ll} \mathbf {t}&{} \text {if } {{\mathrm{\mathcal {A}}}}(P) \le _{\gamma } a\\ \mathbf ? &{} \text {if } {{\mathrm{\mathcal {A}}}}(P) \not \le _{\gamma } a \end{array}\right. } $$
(1) Since \({{\mathrm{\mathcal {A}}}}\) is a total recursive function and \(\le _{\gamma }\) is decidable, we have that \(\sigma ({{\mathrm{\mathcal {A}}}})\) is a total recursive function, namely \(\sigma ({{\mathrm{\mathcal {A}}}})\in {{\mathrm{\mathbb {V}}}}_{\!A}\), and \(\sigma \) is a total recursive function as well. Since, by definition, \(\sigma ({{\mathrm{\mathcal {A}}}})(P,a) = \mathbf {t}\Leftrightarrow {{\mathrm{\mathcal {A}}}}(P) \le _{\gamma } a\), we have that \(\sigma ({{\mathrm{\mathcal {A}}}}) \cong {{\mathrm{\mathcal {A}}}}\). (2) By Lemma 6.2, if \({{\mathrm{\mathcal {A}}}}\) is sound then the equivalent verifier \(\sigma ({{\mathrm{\mathcal {A}}}})\) is sound as well. (3) It turns out that \(\sigma \) is monotonic: if \({{\mathrm{\mathcal {A}}}}\sqsubseteq {{\mathrm{\mathcal {A}}}}'\) then \(\sigma ({{\mathrm{\mathcal {A}}}}')(P,a)=\mathbf {t}\) \(\Leftrightarrow \) \({{\mathrm{\mathcal {A}}}}'(P)\le _{\gamma } a\) \(\Rightarrow \) \({{\mathrm{\mathcal {A}}}}(P)\le _{\gamma } {{\mathrm{\mathcal {A}}}}'(P)\le _{\gamma } a\) \(\Leftrightarrow \) \(\sigma ({{\mathrm{\mathcal {A}}}})(P,a)=\mathbf {t}\), so that \(\sigma ({{\mathrm{\mathcal {A}}}}) \sqsubseteq \sigma ({{\mathrm{\mathcal {A}}}}')\) holds. (4) Assume that \(\sigma ({{\mathrm{\mathcal {A}}}}) \cong \sigma ({{\mathrm{\mathcal {A}}}}')\), hence, for any \(P\in {{\mathrm{Prog}}}\), \(\sigma ({{\mathrm{\mathcal {A}}}})(P,{{\mathrm{\mathcal {A}}}}(P)) = \sigma ({{\mathrm{\mathcal {A}}}}')(P,{{\mathrm{\mathcal {A}}}}(P))\), namely, \({{\mathrm{\mathcal {A}}}}(P)\le _{\gamma } {{\mathrm{\mathcal {A}}}}(P) \,\Leftrightarrow \, {{\mathrm{\mathcal {A}}}}'(P) \le _{\gamma } {{\mathrm{\mathcal {A}}}}(P)\), so that \({{\mathrm{\mathcal {A}}}}'(P) \le _{\gamma } {{\mathrm{\mathcal {A}}}}(P)\) holds. On the other hand, \({{\mathrm{\mathcal {A}}}}(P) \le _{\gamma } {{\mathrm{\mathcal {A}}}}'(P)\) can be dually obtained, therefore \(\gamma ({{\mathrm{\mathcal {A}}}}(P))=\gamma ({{\mathrm{\mathcal {A}}}}'(P))\) holds, namely \({{\mathrm{\mathcal {A}}}}\cong {{\mathrm{\mathcal {A}}}}'\). \(\square \)
Intuitively, Theorem 7.1 shows that program verification on a given abstract domain A can always and unconditionally be reduced to program analysis on A. This means that a solution to the program analysis problem on A, i.e. the definition of an analyser \({{\mathrm{\mathcal {A}}}}\), can constructively be transformed into a solution to the program verification problem on the same domain A, i.e. the design of a verifier \(\sigma ({{\mathrm{\mathcal {A}}}})\) which is equivalent to \({{\mathrm{\mathcal {A}}}}\). The proof of Theorem 7.1 provides this constructive transform \(\sigma \), which is defined as expected: an analyser \({{\mathrm{\mathcal {A}}}}\) on any (possibly infinite) abstract domain A can be used as a verifier for any assertion \(a\in A\) simply by checking whether \({{\mathrm{\mathcal {A}}}}(P)\le _\gamma a\) holds or not.
7.2 Reducing Analysis to Verification
It turns out that the converse of Theorem 7.1 does not hold, namely a program analysis problem in general cannot be reduced to a verification problem. Instead, this reduction can be always done for finite abstract domains. Given a verifier \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A}\), for any program \(P\in {{\mathrm{Prog}}}\), let us define \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) \triangleq \{a\in A~|~ {{\mathrm{\mathcal {V}}}}(P,a)=\mathbf {t}\}\), namely, \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\) is the set of assertions proved by \({{\mathrm{\mathcal {V}}}}\) for P. Also, given an assertion \(a\in A\), we define \(\uparrow \!\!\!\,a \triangleq \{a'\in A~|~ a\le _\gamma a'\}\) as the set of assertions weaker than a. The following result provides a useful characterization of the equivalence between verifiers and analysers.
Lemma 7.2
Let \(\langle A,\gamma ,\le _\gamma \rangle \) be an abstract domain, \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_A\) and \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A}\). Then, \({{\mathrm{\mathcal {A}}}}\cong {{\mathrm{\mathcal {V}}}}\) if and only if for any \(P\in {{\mathrm{Prog}}}\), \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) =\, \uparrow \!\!\!\,{{\mathrm{\mathcal {A}}}}(P)\).
Proof
By Definition 6.1, it turns out that \({{\mathrm{\mathcal {A}}}}\sqsubseteq {{\mathrm{\mathcal {V}}}}\) iff for any P, \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) \subseteq \;\uparrow \!\!\!\,{{\mathrm{\mathcal {A}}}}(P)\), while we have that \({{\mathrm{\mathcal {V}}}}\sqsubseteq {{\mathrm{\mathcal {A}}}}\) iff for any P, \(\uparrow \!\!\!\,{{\mathrm{\mathcal {A}}}}(P) \subseteq {{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\). Thus, \({{\mathrm{\mathcal {A}}}}\cong {{\mathrm{\mathcal {V}}}}\) if and only if for any \(P\in {{\mathrm{Prog}}}\), \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) =\; \uparrow \!\!\!\,{{\mathrm{\mathcal {A}}}}(P)\). \(\square \)
A consequence of Lemma 7.2 is that, given \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A}\), \({{\mathrm{\mathcal {V}}}}\) can be transformed into an equivalent analyser \(\tau ({{\mathrm{\mathcal {V}}}})\in {{\mathrm{\mathbb {A}}}}_A\) if and only if for any program P, an assertion \(a_P\in A\) exists such that \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) =\; \uparrow \!\!\!\,a_P\). In this case, one can then define \(\tau ({{\mathrm{\mathcal {V}}}})(P) \triangleq a_P\).
Lemma 7.3
Let \(\langle A,\gamma ,\le _\gamma \rangle \) be an abstract domain and \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A}\). If \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_A\) is such that \({{\mathrm{\mathcal {A}}}}\cong {{\mathrm{\mathcal {V}}}}\) then: (1) \(A\ne \varnothing \); (2) \({{\mathrm{\mathcal {V}}}}\) is not trivial; (3) \({{\mathrm{\mathcal {V}}}}\) is monotone.
Proof
(1) We observed just after Definition 4.1 that no analyser can be defined on the empty abstract domain. (2) If \({{\mathrm{\mathcal {V}}}}\) is trivial then there exists a program \(Q\in {{\mathrm{Prog}}}\) such that for any \(a\in A\), \({{\mathrm{\mathcal {V}}}}(Q,a)=\mathbf ? \), so that if \({{\mathrm{\mathcal {V}}}}\cong {{\mathrm{\mathcal {A}}}}\) for some \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_A\) then, from \({{\mathrm{\mathcal {V}}}}\sqsubseteq {{\mathrm{\mathcal {A}}}}\) we would derive \({{\mathrm{\mathcal {V}}}}(Q,{{\mathrm{\mathcal {A}}}}(Q))=\mathbf {t}\), which is a contradiction. (3) Assume that \({{\mathrm{\mathcal {V}}}}\) is not monotone. Then, there exist \(Q\in {{\mathrm{Prog}}}\) and \(a,a'\in A\) such that \(a\in {{\mathrm{\mathcal {V}}}}_\mathbf {t}(Q)\), \(a\le _\gamma a'\) but \(a'\not \in {{\mathrm{\mathcal {V}}}}_\mathbf {t}(Q)\). If \({{\mathrm{\mathcal {V}}}}\cong \mathcal {A}\), for some \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_A\), then, by Lemma 7.2, \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(Q)=\,\uparrow \!\!\!\,{{\mathrm{\mathcal {A}}}}(Q)\), so that we would have that \(a\in \,\uparrow \!\!\!\,{{\mathrm{\mathcal {A}}}}(Q)\) but \(a'\not \in \, \uparrow \!\!\!\,{{\mathrm{\mathcal {A}}}}(Q)\), which is a contradiction. \(\square \)
We also observe that even for a nontrivial and monotone verifier \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A}\) on a finite abstract domain A, it is not guaranteed that an equivalent analyser exists. In fact, if an equivalent analyser \({{\mathrm{\mathcal {A}}}}\) exists then, by Lemma 7.2, for any program P, \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\) must contain the least element, namely for any program P it must be the case that there exists a strongest assertion proved by \({{\mathrm{\mathcal {V}}}}\) for P.
Example 7.4
Consider a sign domain such as \(S\triangleq \{\mathbb {Z}_{\le 0}, \mathbb {Z}_{\ge 0}, \mathbb {Z}\}\) where \(\mathbb {Z}_{\le 0} \le _\gamma \mathbb {Z}\) and \(\mathbb {Z}_{\ge 0} \le _\gamma \mathbb {Z}\). For a program such as \(Q \equiv x:=0\), a sound verifier \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_S\) could be able to prove all the assertions in S, namely \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(Q)=S\). However, there exists no assertion \(a_Q\in S\) such that \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(Q) =\; \uparrow \!\!\!\,a_Q\). Hence, by Lemma 7.2, there exists no analyser in \({{\mathrm{\mathbb {A}}}}_S\) which is equivalent to \({{\mathrm{\mathcal {V}}}}\). Also, if \(S' \triangleq \{\mathbb {Z}_{=0}, \mathbb {Z}_{\le 0}, \mathbb {Z}_{\ge 0}, \mathbb {Z}\}\), so that \(S'\) is a meet-semilattice, and \({{\mathrm{\mathcal {V}}}}'\in {{\mathrm{\mathbb {V}}}}_{S'}\) is a sound verifier such that \({{\mathrm{\mathcal {V}}}}'_\mathbf {t}(Q)=S'\smallsetminus \{\mathbb {Z}_{=0} \}\), still, by Lemma 7.2, there exists no analyser in \({{\mathrm{\mathbb {A}}}}_{S'}\) which is equivalent to \({{\mathrm{\mathcal {V}}}}'\). \(\square \)
Definition 7.5
A verifier \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A}\) is finitely meet-closed when for any \(P\in {{\mathrm{Prog}}}\) and \(a, a_1,a_2\in A\), if \({{\mathrm{\mathcal {V}}}}(P,a_1)=\mathbf {t}={{\mathrm{\mathcal {V}}}}(P,a_2)\) and \(\gamma (a)=\gamma (a_1)\cap \gamma (a_2)\) then \({{\mathrm{\mathcal {V}}}}(P,a)=\mathbf {t}\). The following notation will be used: for any domain A,
$$ {{\mathrm{\mathbb {V}}}}_{\!A}^+ \triangleq \{{{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A} ~|~ {{\mathrm{\mathcal {V}}}}\text { is nontrivial, monotone and finitely meet-closed}\}. $$
\(\square \)
Thus, finitely meet-closed verifiers can prove logical conjunctions of provable assertions.
Theorem 7.6
(Reduction for Finite Domains). Let \(\langle A,\gamma ,\le _\gamma \rangle \) be a nonempty finite abstract domain. There exists a transform \(\tau : {{\mathrm{\mathbb {V}}}}^+_A \rightarrow {{\mathrm{\mathbb {A}}}}_A\) such that:
- (1):
-
\(\tau \) is a total recursive function such that for all \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}^+_A\), \(\tau ({{\mathrm{\mathcal {V}}}}) \cong {{\mathrm{\mathcal {V}}}}\);
- (2):
-
if \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}^+_A\) is sound then \(\tau ({{\mathrm{\mathcal {V}}}})\) is sound;
- (3):
-
\(\tau \) is monotonic;
- (4):
-
\(\tau ({{\mathrm{\mathcal {V}}}}) \cong \tau ({{\mathrm{\mathcal {V}}}}') \Rightarrow {{\mathrm{\mathcal {V}}}}\cong {{\mathrm{\mathcal {V}}}}'\).
Proof
(1) Let \(A=\{a_1,...,a_n\}\) be any enumeration of A, with \(n\ge 1\). Given \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A}^+\), we define \(\tau ({{\mathrm{\mathcal {V}}}}): {{\mathrm{Prog}}}\rightarrow A\) as follows:
$$ \tau ({{\mathrm{\mathcal {V}}}})(P) \triangleq {\left\{ \begin{array}{ll} r:= \text {undef};\\ \mathbf{forall }\,\, i\in 1..n \,\,\mathbf{do }\\ \qquad \mathbf{if }\,\, \big (a_i \in {{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) \,\wedge \, (r= \text {undef} \;\vee \; a_i\le _\gamma r)\big ) \,\,\mathbf{then }\,\, r:=a_i ;\\ \mathbf{output }\,\, r \end{array}\right. } $$
Then, it turns out that \(\tau \) is a total recursive function. Since \({{\mathrm{\mathcal {V}}}}\) is a total recursive function, A is finite and \(\le _\gamma \) is decidable, we have that \(\tau ({{\mathrm{\mathcal {V}}}})\) is a total recursive function, so that \(\tau ({{\mathrm{\mathcal {V}}}})\in {{\mathrm{\mathbb {A}}}}_A\). Since \({{\mathrm{\mathcal {V}}}}\) is not trivial, for any \(P\in {{\mathrm{Prog}}}\), \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\ne \varnothing \). Also, since A is finite and \({{\mathrm{\mathcal {V}}}}\) is finitely meet-closed there exists some \(a_k\in {{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\) such that \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\subseteq \; \uparrow \!\!\!\,a_k\), so that \(\tau ({{\mathrm{\mathcal {V}}}})(P)\) outputs some value in A. Moreover, since \({{\mathrm{\mathcal {V}}}}\) is monotone, \(\uparrow \!\!\!\,a_k\subseteq {{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\), so that \(\uparrow \!\!\!\,a_k = {{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\). Thus, the above procedure defining \(\tau ({{\mathrm{\mathcal {V}}}})(P)\) finds and outputs \(a_k\). Hence, for any \(P\in {{\mathrm{Prog}}}\) and \(a\in A\), \({{\mathrm{\mathcal {V}}}}(P,a)=\mathbf {t}\Leftrightarrow a\in {{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) \Leftrightarrow a\in \,\uparrow \!\!\!\,a_k \Leftrightarrow a_k \le _\gamma a \Leftrightarrow \tau ({{\mathrm{\mathcal {V}}}})(P) \le _\gamma a\), that is, \(\tau ({{\mathrm{\mathcal {V}}}}) \cong {{\mathrm{\mathcal {V}}}}\) holds.
(2) By Lemma 6.2, if \({{\mathrm{\mathcal {V}}}}\) is sound then the equivalent analyser \(\tau ({{\mathrm{\mathcal {V}}}})\) is sound as well.
(3) It turns out that \(\tau \) is monotonic: if \({{\mathrm{\mathcal {V}}}}\sqsubseteq {{\mathrm{\mathcal {V}}}}'\) then, by definition, \({{\mathrm{\mathcal {V}}}}'_\mathbf {t}(P) \subseteq {{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)\), so that, since \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) = \,\uparrow \!\!\!\,\tau ({{\mathrm{\mathcal {V}}}})(P)\) and \({{\mathrm{\mathcal {V}}}}'_\mathbf {t}(P) = \,\uparrow \!\!\!\,\tau ({{\mathrm{\mathcal {V}}}}')(P)\), we obtain \(\tau ({{\mathrm{\mathcal {V}}}})(P)\le _\gamma \tau ({{\mathrm{\mathcal {V}}}}')(P)\), namely \(\tau ({{\mathrm{\mathcal {V}}}}) \sqsubseteq \tau ({{\mathrm{\mathcal {V}}}}')\) holds.
(4) Assume that \(\tau ({{\mathrm{\mathcal {V}}}}) \cong \tau ({{\mathrm{\mathcal {V}}}}')\). Hence, for any \(P\in {{\mathrm{Prog}}}\), \(\gamma (\tau ({{\mathrm{\mathcal {V}}}})(P)) = \gamma (\tau ({{\mathrm{\mathcal {V}}}}')(P))\), so that, since \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) = \;\uparrow \!\!\!\,\tau ({{\mathrm{\mathcal {V}}}})(P)\) and \({{\mathrm{\mathcal {V}}}}'_\mathbf {t}(P) = \;\uparrow \!\!\!\,\tau ({{\mathrm{\mathcal {V}}}}')(P)\), we obtain \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)={{\mathrm{\mathcal {V}}}}'_\mathbf {t}(P)\), namely \({{\mathrm{\mathcal {V}}}}= {{\mathrm{\mathcal {V}}}}'\). \(\square \)
An example of this reduction of verification to static analysis for finite domains is dataflow analysis as model checking shown in [31] (excluding Kildall’s constant propagation domain [16]). Let us now focus on infinite domains of assertions.
Lemma 7.7
There exists a denumerable infinite abstract domain \(\langle A,\gamma ,\le _\gamma \rangle \) and a verifier \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}^+_A\) such that for any analyser \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_A\), \({{\mathrm{\mathcal {A}}}}\not \cong {{\mathrm{\mathcal {V}}}}\).
Proof
Let us consider the infinite domain \({{\mathrm{T}}}\triangleq \mathbb {N}\cup \{\top \}\) together with the following concretization function: \(\gamma (\top ) \triangleq {{\mathrm{Prog}}}\) and, for any \(n\in \mathbb {N}\),
$$ \gamma (n) \triangleq \{P\in {{\mathrm{Prog}}}~|~ P \text { on input } 0 \text { converges in } n \text { or fewer steps}\} $$
where the number of steps is determined by a small-step operational semantics \(\Rightarrow \), as recalled in Sect. 2. Thus, we have that if \(n,m\in \mathbb {N}\) then \(n \le _\gamma m\) iff \(n\le _\mathbb {N}m\), while \(n\le _\gamma \top \). We define a function \({{\mathrm{\mathcal {V}}}}:{{\mathrm{Prog}}}\times {{\mathrm{T}}}\rightarrow \{\mathbf {t},\mathbf ? \}\) as follows:
$$ {{\mathrm{\mathcal {V}}}}(P,a) \triangleq {\left\{ \begin{array}{ll} \mathbf {t}&{} \text {if }a=\top \\ \mathbf {t}&{} \text {if } a=n \text { and } P \text { on input } 0 \text { converges in } n \text { or fewer steps}\\ \mathbf ? &{} \text {if } a=n \text { and } P \text { on input } 0 \text { does not converge in } n \text { or fewer steps}\\ \end{array}\right. } $$
Clearly, for any number \(n\in \mathbb {N}\), the predicate “P on input 0 converges in n or fewer steps” is decidable, where the input 0 could be replaced by any other (finite set of) input value(s). Hence, \({{\mathrm{\mathcal {V}}}}\) turns out to be a total recursive function, that is, a verifier on the abstract domain \({{\mathrm{T}}}\). In particular, let us remark that \({{\mathrm{\mathcal {V}}}}\) is a sound verifier. Moreover, \({{\mathrm{\mathcal {V}}}}\) is nontrivial, since, for any \(P\in {{\mathrm{Prog}}}\), \({{\mathrm{\mathcal {V}}}}(P,\top )=\mathbf {t}\), and monotone because if \({{\mathrm{\mathcal {V}}}}(P,n)=\mathbf {t}\) and \(n\le _\gamma a\) then either \(a=\top \) and \({{\mathrm{\mathcal {V}}}}(P,\top )=\mathbf {t}\) or \(a=m\), so that \(n\le _\mathbb {N}m\) and therefore \({{\mathrm{\mathcal {V}}}}(P,m)=\mathbf {t}\). Clearly, \({{\mathrm{\mathcal {V}}}}\) is also finitely meet-closed, because if \({{\mathrm{\mathcal {V}}}}(P,a_1)=\mathbf {t}={{\mathrm{\mathcal {V}}}}(P,a_2)\) and \(\gamma (a)=\gamma (a_1)\cap \gamma (a_2)\) then either \(a=a_1\) or \(a=a_2\), so that \({{\mathrm{\mathcal {V}}}}(P,a)=\mathbf {t}\). Summing up, it turns out that \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}^+_{{{\mathrm{T}}}}\). Assume now, by contradiction, that there exists an analyser \({{\mathrm{\mathcal {A}}}}\in {{\mathrm{\mathbb {A}}}}_{{{\mathrm{T}}}}\) such that \({{\mathrm{\mathcal {A}}}}\cong {{\mathrm{\mathcal {V}}}}\). By Lemma 7.2, for any \(P\in {{\mathrm{Prog}}}\), we have that \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P) = \;\uparrow \!\!\!\,{{\mathrm{\mathcal {A}}}}(P)\). Hence, if P on input 0 diverges then \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)=\{\top \}\) so that \({{\mathrm{\mathcal {A}}}}(P)=\top \), while if P on input 0 converges in exactly n steps then \({{\mathrm{\mathcal {V}}}}_\mathbf {t}(P)=\{m\in \mathbb {N}~|~ m\ge n\}\cup \{\top \}\), so \({{\mathrm{\mathcal {A}}}}(P)=n\), namely \({{\mathrm{\mathcal {A}}}}\) goes as follows:
$$ {{\mathrm{\mathcal {A}}}}(P)= {\left\{ \begin{array}{ll} \top &{} \text {if } P \text { on input } 0 \text { diverges}\\ n &{} \text {if } P \text { on input } 0 \text { converges in exactly } n \text { steps} \end{array}\right. } $$
Since \({{\mathrm{\mathcal {A}}}}\) is a total recursive function, we would have defined an algorithm \({{\mathrm{\mathcal {A}}}}\) for deciding if a program \(P\in {{\mathrm{Prog}}}\) on input 0 terminates or not. Since \({{\mathrm{Prog}}}\) is assumed to be Turing complete with respect to the operational semantics \(\Rightarrow \), this leads to a contradiction. \(\square \)
As a straight consequence of Lemma 7.7, the following theorem proves that for any infinite abstract domain A, no reduction from verifiers in \({{\mathrm{\mathbb {V}}}}^+_A\) to equivalent analysers in \({{\mathrm{\mathbb {A}}}}_A\) is possible.
Theorem 7.8
(Impossibility of the Reduction for Infinite Domains). For any denumerable infinite abstract domain \(\langle A,\gamma ,\le _\gamma \rangle \), there exists no function \(\tau : {{\mathrm{\mathbb {V}}}}^+_A \rightarrow {{\mathrm{\mathbb {A}}}}_A\) such that \(\tau \) is a total recursive function and for all \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}^+_A\), \(\tau ({{\mathrm{\mathcal {V}}}}) \cong {{\mathrm{\mathcal {V}}}}\).
Proof
Assume, by contradiction, that \(\tau : {{\mathrm{\mathbb {V}}}}^+_A \rightarrow {{\mathrm{\mathbb {A}}}}_A\) is a total recursive function such that for all \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}^+_A\), \(\tau ({{\mathrm{\mathcal {V}}}})\in {{\mathrm{\mathbb {A}}}}_A\) and \(\tau ({{\mathrm{\mathcal {V}}}}) \cong {{\mathrm{\mathcal {V}}}}\). Then, for the infinite domain A and verifier \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}^+_A\) provided by Lemma 7.7, we would be able to construct an analyser \(\tau ({{\mathrm{\mathcal {V}}}})\in {{\mathrm{\mathbb {A}}}}_A\) such that \(\tau ({{\mathrm{\mathcal {V}}}})\cong {{\mathrm{\mathcal {V}}}}\), which would be in contradiction with Lemma 7.7. \(\square \)
Intuitively, this result states that given any infinite abstract domain A, no general algorithm exists for constructively designing out of a reasonable (i.e., nontrivial, monotone and finitely meet-closed) verifier \({{\mathrm{\mathcal {V}}}}\) on A an equivalent analyser on the same domain A. This can be read as a precise statement proving the folklore belief that “program analysis is harder than verification”, at least for infinite domains of program assertions. It is important to remark that the verifier \({{\mathrm{\mathcal {V}}}}\in {{\mathrm{\mathbb {V}}}}_{\!A}^+\) on the infinite domain A defined by the proof of Lemma 7.7 is sound. Thus, even if we restrict the reduction transform \(\tau :{{\mathrm{\mathbb {V}}}}^{+,\text {sound}}_A \rightarrow {{\mathrm{\mathbb {A}}}}^{\text {sound}}_A\) of Theorem 7.8 to be applied to sound verifiers—so that by Lemma 6.2 the range would be the sound analysers in \({{\mathrm{\mathbb {A}}}}_A\)—the same proof of Lemma 7.7 could still be used for proving that such transform \(\tau \) cannot exist.
A further consequence of Theorem 7.8 is the fact proved in [10] that abstract interpretation-based program analysis with infinite domains and widening/narrowing operators is strictly more powerful than with finite domains.