II. Monotone Frameworks (2.3)
  Can we identify some commonalities between different analyses?
  Would doing that help implement them?
 A. general pattern
------------------------------------------
          GENERAL PATTERN

A_o(l) = if l \in E then i
         else
         

A_.(l) = 

where

  \bigsqcup is either \bigcup or \bigcap

  F is either flow(S*) or flow^R(S*)

  E is {init(S*)} or final(S*)

  i is initial/final information

  f(l) is the transfer function for
       blocks B^l \in blocks(S*)

For a forward analysis:

  F is flow(S*)
  A_o gives the entry conditions
  A_. gives the exit conditions

For a backward analysis:

  F is flow^R(S*)
  A_o gives the exit conditions
  A_. gives the entry conditions

------------------------------------------
 B. basic definitions (2.3.1)
  1. property space
------------------------------------------
         PROPERTY SPACES

def: a *property space*,
     L = (L, \bigsqcup), is a set with
     \bigsqcup: Powerset(L) -> L
     a join operation
     that makes it a complete lattice.

Thus:

  l1 \sqcup l2 = \bigsqcup { l1, l2 }

  \bot = \bigsqcup {}

  l1 \sqsubseteq l2 = (l1 \sqcup l2 = l2)

Examples:

 For reaching definitions:

     L = Powerset(Var* x Lab^?_*)
     \sqcup = \cup
     \sqsubseteq = \subseteq

 For available expressions:

     L = Powerset(AExp*)
     \sqcup = \cap
     \sqsubseteq = \supseteq

------------------------------------------
  2. transfer functions
------------------------------------------
          TRANSFER FUNCTION SPACE

def: Let L be a partially-ordered set.
     Then Funs is a 
     *transfer function space for L* iff

     f \in Funs
         ==> f : L -> L and f is monotone,

     f,g \in Funs ==> f o g \in Funs, and

     id_L \in Funs.
------------------------------------------
  3. monotone framework
------------------------------------------
         MONOTONE FRAMEWORK

def: (L, Funs) is a monotone framework
     iff L is a property space and Funs
     is a transfer function space for L.

def: (L, Funs, F, E, i, f_.) is an
 *instance of a monotone framework*
 if and only if:

 - (L, Funs) is a monotone framework,

 - F is a finite set of pairs (of flows),

 - E is a finite set of extremal labels,

 - i \in L is an extremal value,

 - f : (dom(F) \cup E) -> (L -> L)
        s.t. for l in (dom(F) \cup E)
              f_l \in Funs
------------------------------------------
 C. examples (2.3.2)
 D. predicate abstraction (new topic)
------------------------------------------
          PREDICATE ABSTRACTION

Goal: verify program properties
Idea: Use property space of the form

  L = Powerset(Preds)

  Preds = {P1, ..., Pn}
     where each Pi is a nullary predicate

Interpretation:

  {P3,P5} means P3 and P5 may/must be true
      (depending on kind of analysis)

  \sqcup is \cup

  Funs = monotonic (in \subseteq) functions on L
------------------------------------------
  What's the bottom element?  The top?
  How can you represent states?
------------------------------------------
       PREDICATE ABSTRACTION EXAMPLE

IsZero Analysis:

    At a given program point,
    which variables may be 0.

"Abstract States"
  s \in L = Powerset(Preds)

  where
   Preds = {IsZero_x | x in Vars*}

   IsZero_y means y may be 0
   
 F is flow(S*)
 E is {init(S*)}
 i is Preds

 fIZ(l) : L -> L, for l in Lab*

 fIZ(l)(s) = (s \ kill_IZ(B^l)(s)) \cup gen_IZ(B^l)(s)
                where B^l in blocks(S*)

  kill_IZ([x := a]^l)(s) = {IsZero_x}
  kill_IZ([skip]^l)(s) = {}
  kill_IZ([b]^l)(s) = {}

  gen_IZ([x := a]^l)(s) = 
        {IsZero_x | (\exists cs \in \gamma(s) :: A[[a]]cs == 0)}
  gen_IZ([skip]^l)(s) = {}
  gen_IZ([b]^l)(s) = {}

  \gamma: L -> Store
  \gamma(s) = {cs | cs: Var* -> Int, IsZero_x \in s ==> cs(x) == 0}
 
------------------------------------------
        What kind of analysis is this?
        Why this initial value i?
        What do the gen and kill functions do?
        What are the equations for IZ_entry(l) and IZ_exit(l)?
------------------------------------------
          EXAMPLE

  [y := 3]^1;
  while [y>0]^2
  do ([q := y-2]^3;
      [y := y-1]^4);
  [q := q div y]^5

Var* = {y, q}
Preds = {IsZero_y, IsZero_q}

IZ_entry(1) = 
IZ_exit(1) = 
IZ_entry(2) =
IZ_exit(2) = 
IZ_entry(3) = 
IZ_exit(3) = 
IZ_entry(4) = 
IZ_exit(4) = 
IZ_entry(5) = 
IZ_exit(5) = 

------------------------------------------
 E. equation solving (2.4)
  1. MFP (Maximal Fixed Point) solution (2.4.1)
  2. MOP solution (2.4.2) (skip)