A calculus of logical relations for generating over-and under-approximating static analyses

Motivated by Dams’s studies of overand underapproximation of state-transition relations, we define a calculus for Galois-connection building based on logical relations. For concrete domain, C, and corresponding abstract domain, A, we work with closed, binary approximation relations of the form, ρτ ⊆ C × A. We document the closure properties required to generate a Galois connection, C 〈ατ , γτ 〉A, from ρτ and show how the closure properties are generated and preserved when lifting ρτ to a higher order relation, ρF [τ ] ⊆ F [C] × F [A]. Next, we synthesize Dams’ most-precise underand overapproximation transition relations using a calculus of logical relations on function space, lower powerset (for overapproximation), and upper powerset (for underapproximation); corollaries from Galois-connection theory give Dams’s hard-won completeness results. As a bonus, the calculus of logical relations induces a validation logic; for Dams’s case study, the logic is Hennessy-Milner logic. An immediate corollary is that the synthesized overand underapproximation transition relations validate the most logical properties that hold true for the corresponding concrete state-transition relation. Galois connections underlie most static analyses of programs [8, 27, 35]: For complete lattices, C and A, a pair of monotone maps, α : C → A and γ : A → C, define a Galois connection, written C〈α, γ〉A, iff α ◦ γ vA idA and γ ◦α wC idC [8, 15]. Galois connections possess rich internal structure [9, 15, 32, 40], and one purpose of this paper is to use binary relations, ρτ ⊆ C × A [4, 20], to expose this structure and generate C〈ατ , γτ 〉A. By working within a family of logical relations, we can lift ρτ to a higher-typed relation, ρF [τ ] ⊆ F [C] × F [A], that generates a Galois connection, F [C]〈αF [τ ], γF [τ ]〉F [A], between the higher-typed domains [1, 4]. The logical-relations approach reveals an important fact: Overand underapproximation static analyses, which should be duals, indeed arise from dual constructions: a lower (“Hoare”) powerset relation [21, 23, 36] generates an overapproximation Galois connection, and an upper (”Smyth”) powerset relation [21, 23, 36, 41] generates an underapproximation. This characterization gives a simple explanation of Dennis Dams’s detailed studies of most-precise underand ? www.cis. ksu.edu/∼schmidt. Supported by NSF ITR-0085949 and ITR-0086154. overapproximations of state-transition systems [12, 14]. Indeed, this paper uses Dams’s work to motivate, present, and justify our formulation of Galois connections as closed, logical relations. The paper is structured as follows. Section 1 reviews the traditional treatment of overand underapproximation as dual constructions, exposes the inherent difficulty in the duality, and suggests an alternative approach that uses lower and upper powersets. The alternative is applied in Section 2, showing how one might simplify Dams’s results on overand underapproximation. The formal development begins in Section 3, where Galois connections are characterized as U-GLB-L-LUB-closed binary relations between concrete and abstract domains. The lower and upper powerset constructions are carefully developed in Section 4, preparing the way in Section 5 for a calculus of logical relations that utilizes function and powerset types. Generation and preservation of closure properties within the calculus are proved in Section 6, and Sections 7 and 8 apply the results to synthesizing Dams’s most-precise overand underapproximating state-transition relations. Finally, Section 9 defines a validation logic extracted from the logical relations and shows that the most-precise approximation relations preserve the most properties in the logic. 1 Overand underapproximation as duals Almost all Galois-connection-based static analyses are overapproximating: Given a set, C, of concrete values and a complete lattice, (A,vA), of abstract values, we build a Galois connection, (P(C),⊆)〈αo, γ〉(A,vA), and we say that S ⊆ C is (over-)approximated by a ∈ A iff S ⊆ γ(a). A standard example is approximation by parity, e.g.,