Program Analysis is Harder than Verification: A Computability Perspective

Abstract

We study from a computability perspective static program analysis, namely detecting sound program assertions, and verification, namely sound checking of program assertions. We first provide a general computability model for domains of program assertions and corresponding program analysers and verifiers. Next, we formalize and prove an instantiation of Rice's Theorem for static program analysis and verification. Then, within this general model, we provide and show a precise statement of the popular belief that program analysis is a harder problem than program verification: we prove that for finite domains of program assertions, program analysis and verification are equivalent problems, while for infinite domains, program analysis is strictly harder than verification.

Static Analysis for ECMAScript String Manipulation Programs

“…Over the years, there has always been the intuition that program analysis was harder than verification: given a program, the aim of the former is to derive invariants for each program point, the one of the latter is instead to check whether a certain property holds for the given input program. Recently, this concept has been formalized from a computability point of view [41], confirming this belief. Therefore, our approach, placed in the context of static analysis of string manipulation programs, has goals that are hardly comparable with the solutions proposed in the context of verification, such as those cited above.…”

History of Abstract Interpretation

“…As observed by Floyd [14], invariants represent properties of recursive definitions as well as of iterative commands and, as pointed out by Edsger Wybe Dijkstra [20], finding strong enough invariants is the main challenge in proving program correctness, due to the undecidability of program termination. In their very essence, program analysis and program verification correspond precisely to automatically derive -i.e., through an algorithm -an invariant which is strong enough to let us prove statically -i.e., at compile-time or anyway before program execution -that some expected or desired property holds at run-time [21]. Major examples of program properties that can be statically inferred by automatically deriving program invariants are the absence of bugs -the so-called safety program properties -and the information on program variables used for code optimization in program compilation, such as liveness and constancy of variables as derived by classical data-flow analysis.…”

Intensional Kleene and Rice Theorems for Abstract Program Semantics

“…We adapt the general definition of static program verifier of Cousot et al [7,Definition 4.3] to our framework. Given a program property P ⊆ N to check, a static program verifier is a total recursive function V : N → {0, 1}, which is sound when for all p ∈ N, V(p) = 1 ⇒ p ∈ P , while V is precise if the reverse implication also holds, i.e., when V(p) = 1 ⇔ p ∈ P holds.…”

“…For instance, even some programs with an exponential lower bound will be wrongly classified by V as programs that do not meet a cubic lower bound. ◀As shown by Cousot et al[7, Theorem 5.4], precise static verifiers cannot be designed (unless for trivial program properties). The examples above prove that, additionally, we cannot have any certain information on an input program p whenever the output of a sound (and imprecise) verifier for p is 0.…”