Definitions and Notations
1. Let 𝐺 be some Context Graph, then 𝑉(𝐺)is a set of reset contexts in 𝐺 and 𝐸(𝐺)is a set of arcs between the
contexts of 𝐺, each arc associated with a DFR.
2. For a context graph arc (𝑃, 𝑄) ∈ 𝐶𝐺, denote 𝐷𝐹𝑅(𝑃, 𝑄) to be the DFR associated with arc (𝑃, 𝑄).
3. Let (𝐶𝐺, 𝑃, 𝑄) be the specific context graph arc (𝑃, 𝑄) which is in 𝐸(𝐶𝐺), for context graph 𝐶𝐺.
4. Let (𝑃, 𝑄, 𝑑𝑓𝑟) ∈ 𝐶𝐺 be a context graph arc with its associated DFR.
5. For some core language command 𝐶, let 𝐶𝐺(𝐶) to be the context graph associated with this command.
6. Let 𝐶𝑜𝑚𝑚𝑎𝑛𝑑 = 𝑆𝑘𝑖𝑝 |𝑋𝑖 ≔ 𝑒 |𝐶1 ; 𝐶2 | 𝐶ℎ𝑜𝑜𝑠𝑒 𝐶1 𝑜𝑟 𝐶2 | 𝐿𝑜𝑜𝑝 𝑋𝑖 { 𝐶 }
𝐶, 𝐶1 , 𝐶2 ∈ 𝐶𝑜𝑚𝑚𝑎𝑛𝑑, 𝑒 ∈ 𝐸𝑥𝑝𝑟𝑒𝑠𝑠𝑖𝑜𝑛, 𝑋𝑖 ∈ 𝑉𝑎𝑟
7. Let 𝐶𝑜𝑛𝑡𝑒𝑥𝑡𝑠 be the set of all possible reset-contexts
(e.g., for a program with 3 variables: 𝐶𝑜𝑛𝑡𝑒𝑥𝑡𝑠 = {{ }, {1}, {2}, {3}, {1,2}, {1,3}, {2,3}, {1,2,3}} )
𝑑
8. Let 𝑑𝑚𝑎𝑥 (𝐶𝐺, 𝑖 → 𝑗) = max {𝑑 |∃𝑒∈𝐸(𝐶𝐺) ∶ [
] ∈ 𝐷𝐹𝑅(𝑒)}.
𝑖→𝑗
( 𝑑𝑚𝑎𝑥 is the maximal value of any data flow between variable 𝑋𝑖 to variable 𝑋𝑗 which exists in any DFR
associated with any arc of Context Graph 𝐶𝐺 ).
9. For context-graph arcs 𝑒1 ∈ 𝐶𝐺1 , 𝑒2 ∈ 𝐶𝐺2 we denote the fact that 𝑒1 and 𝑒2 has the same pre-context and
post-context by 𝒆𝟏 =𝒂 𝒆𝟐 .
10. Similarly, we denote the fact that 𝑒1 and 𝑒2 do not have the same pre-context and post-context by 𝒆𝟏 ≠𝒂 𝒆𝟐 .
A. Let 𝑑𝑓𝑟1 , 𝑑𝑓𝑟2 be two DFRs. We say that "𝒅𝒇𝒓𝟐 𝒔𝒖𝒃𝒔𝒖𝒎𝒆𝒔 𝒅𝒇𝒓𝟏 ", denoted as 𝒅𝒇𝒓𝟐 ⊒ 𝒅𝒇𝒓𝟏 , if and only if
all of the following formulae are true:
1. ∀𝑖,𝑗∈𝑉𝐴𝑅𝑆,
𝑑∈𝔻
∶ [
2. ∀𝑖,𝑗,𝑖′ ,𝑗′ ∈𝑉𝐴𝑅𝑆 ∶ [
𝑑
𝑑′
] ∈ 𝑑𝑓𝑟1 → (∃𝑑′ ∈𝔻 : 𝑑′ ≥ 𝑑 ∧ [
] ∈ 𝑑𝑓𝑟2 )
𝑖→𝑗
𝑖→𝑗
𝑖→𝑗
𝑑
𝑑′
′
∈
𝑑𝑓𝑟
→
∃
:
∈
𝑑𝑓𝑟
∧
]
[
]
[
] ∈ 𝑑𝑓𝑟2
1
2
𝑑,𝑑 ∈𝔻 𝑖 → 𝑗
𝑖′ → 𝑗′
𝑖′ → 𝑗′
𝑖→𝑗
𝑖→𝑗
𝑑
𝑑′
′
3. ∀𝑖,𝑗,𝑖′ ,𝑗′ ∈𝑉𝐴𝑅𝑆 ∶ ([ ′
] ∈ 𝑑𝑓𝑟2
′ ] ∈ 𝑑𝑓𝑟1 ∧ (∃𝑑, 𝑑 ≃ 1 ∶ [𝑖 → 𝑗] ∈ 𝑑𝑓𝑟2 ∧ [𝑖 ′ → 𝑗 ′ ] ∈ 𝑑𝑓𝑟2 )) → [ ′
𝑖 →𝑗
𝑖 → 𝑗′
B. Let (𝑃, 𝑄), (𝑃, 𝑄 ′ ) ∈ 𝐶𝐺 be two context graph 𝐶𝐺 arcs. We say that arc (𝑷, 𝑸′ ) 𝒔𝒖𝒃𝒔𝒖𝒎𝒆𝒔 (𝑷, 𝑸),
denoted (𝑷, 𝑸′ ) ⊒ (𝑷, 𝑸), If and only if:
𝑄 ′ ⊆ 𝑄 ∧ (𝐷𝐹𝑅(𝑃, 𝑄′) ⊒ 𝐷𝐹𝑅(𝑃, 𝑄))
C. Let 𝐶𝐺1 and 𝐶𝐺2 be two context graphs. We say that "𝐶𝐺2 𝑠𝑢𝑏𝑠𝑢𝑚𝑒𝑠 𝐶𝐺1 ", denoted as 𝐶𝐺2 ⊒ 𝐶𝐺1 if and
only if:
∀𝑒1 ∈ 𝐸(𝐶𝐺1 ) ∃𝑒2 ∈ 𝐸(𝐶𝐺2 ) ∶ 𝑒2 ⊒ 𝑒1
D. Let 𝒜 be the Abstract Interpreter algorithm without subsumption, then 𝒜(𝐶, 𝑝𝑐) is the result Context
Graph of running 𝒜 with command 𝐶and pre-contexts set 𝑝𝑐 ⊆ 𝐶𝑜𝑛𝑡𝑒𝑥𝑡𝑠, as input.
E. Let 𝒜 𝑠 be the Abstract Interpreter algorithm with subsumption, then we define the effect of 𝒜 𝑠 as:
𝒜 𝑠 (𝐶, 𝑝𝑐) = {
𝒜(𝐶, 𝑝𝑐)
𝐶 = 𝑆𝑘𝑖𝑝
max(𝒜(𝐶, 𝑝𝑐) )
𝑒𝑙𝑠𝑒
⊒
Theorem(The abstract Interpreter algorithm with Subsumption yields the same worst-case results):
∀𝑖, 𝑗 ∈ 𝑉𝐴𝑅𝑆, 𝐶 ∈ 𝐶𝑜𝑚𝑚𝑎𝑛𝑑, 𝑝𝑐 ∈ 𝐶𝑜𝑛𝑡𝑒𝑥𝑡𝑠 ∶ 𝑑𝑚𝑎𝑥 (𝒜 𝑠 (𝐶, 𝑝𝑐), 𝑖 → 𝑗) = 𝑑𝑚𝑎𝑥 (𝒜(𝐶, 𝑝𝑐), 𝑖 → 𝑗)
Lemma A0(𝑻𝒓𝒂𝒏𝒔𝒊𝒕𝒊𝒗𝒊𝒕𝒚 𝒐𝒇 𝒕𝒉𝒆 ⊑ relation for context graph arcs):
(𝑃, 𝑄) ⊒ (𝑃, 𝑅) ∧ (𝑃, 𝑅) ⊒ (𝑃, 𝑆) → (𝑃, 𝑄) ⊒ (𝑃, 𝑆)
Lemma A1(⊔ 𝑝𝑟𝑒𝑠𝑒𝑟𝑣𝑒𝑠 𝒕𝒉𝒆 ⊑ relation for context graph arcs):
Let 𝑒1 =𝑎 𝑒2 be some context graph arcs, then 𝑒1 ⊔ 𝑒2 ⊒ 𝑒1
Lemma A2(⊔ 𝑝𝑟𝑒𝑠𝑒𝑟𝑣𝑒𝑠 𝒕𝒉𝒆 ⊑ relation for context graph arcs):
Let 𝑒1 =𝑎 (𝑃, 𝑄), 𝑒2 =𝑎 (𝑃, 𝑄 ′ ) be some context graph 𝐶𝐺 arcs, s.t. 𝑒2 ⊒ 𝑒1
Let 𝑒1′ =𝑎 𝑒1 , 𝑒2′ =𝑎 𝑒2 be some context graph 𝐶𝐺′ arcs, s.t. 𝑒2′ ⊒ 𝑒1′
Then: 𝑒2 ⊔ 𝑒2′ ⊒ 𝑒1 ⊔ 𝑒1′
Lemma A3(𝓐𝒔 subsumes 𝓐):
∀𝐶 ∈ 𝐶𝑜𝑚𝑚𝑎𝑛𝑑, 𝑝𝑐 ∈ 𝐶𝑜𝑛𝑡𝑒𝑥𝑡𝑠 ∶ 𝒜 𝑠 (𝐶, 𝑝𝑐) ⊒ 𝒜(𝐶, 𝑝𝑐)
Lemma A4(𝓐𝒔 preserves worst-case results of 𝓐):
∀𝑖, 𝑗 ∈ 𝑉𝐴𝑅𝑆, 𝐶 ∈ 𝐶𝑜𝑚𝑚𝑎𝑛𝑑 ∶ 𝑑𝑚𝑎𝑥 (𝒜 𝑠 (𝐶), 𝑖 → 𝑗) ≥ 𝑑𝑚𝑎𝑥 (𝒜(𝐶), 𝑖 → 𝑗)
Lemma B(𝓐𝒔 does not give higher worst-case results than 𝓐):
∀𝑖, 𝑗 ∈ 𝑉𝐴𝑅𝑆, 𝐶 ∈ 𝐶𝑜𝑚𝑚𝑎𝑛𝑑 ∶ 𝑑𝑚𝑎𝑥 (𝒜 𝑠 (𝐶), 𝑖 → 𝑗) ≤ 𝑑𝑚𝑎𝑥 (𝒜(𝐶), 𝑖 → 𝑗)
Proof of Lemma A0:
Let 𝑒1 = (𝑃, 𝑄), 𝑒2 = (𝑃, 𝑅), 𝑒3 = (𝑃, 𝑆), be some three context graph arcs,
s.t. 𝑒1 ⊒ 𝑒2 ∧ 𝑒2 ⊒ 𝑒3 . It follows from definition B that 𝑅 ⊆ 𝑄 and 𝑆 ⊆ 𝑅.
From the transitivity of the ⊆ relation, we get 𝑆 ⊆ 𝑄. Let 𝑑𝑓𝑟𝑖 = 𝐷𝐹𝑅(𝑒𝑖 ), 𝑖 = 1,2,3.
From 𝑒2 ⊒ 𝑒3 and definition A, we get:
(1) ∀𝑖,𝑗∈𝑉𝐴𝑅𝑆,
𝑑∈𝔻
∶ [
(2) ∀𝑖,𝑗,𝑖′ ,𝑗′ ∈𝑉𝐴𝑅𝑆 ∶ [
𝑑
𝑑′
] ∈ 𝑑𝑓𝑟3 → (∃𝑑′ ∈𝔻 : 𝑑′ ≥ 𝑑 ∧ [
] ∈ 𝑑𝑓𝑟2 )
𝑖→𝑗
𝑖→𝑗
𝑖→𝑗
𝑑
𝑑′
′
′ ] ∈ 𝑑𝑓𝑟3 → ∃𝑑,𝑑 ′ ∈𝔻 : [𝑖 → 𝑗] ∈ 𝑑𝑓𝑟2 ∧ [𝑖 ′ → 𝑗 ′ ] ∈ 𝑑𝑓𝑟2
𝑖 →𝑗
𝑖→𝑗
𝑖→𝑗
𝑑
𝑑′
′
(3) ∀𝑖,𝑗,𝑖′ ,𝑗′ ∈𝑉𝐴𝑅𝑆 ∶ ([ ′
] ∈ 𝑑𝑓𝑟2
′ ] ∈ 𝑑𝑓𝑟3 ∧ (∃𝑑, 𝑑 ≃ 1 ∶ [𝑖 → 𝑗] ∈ 𝑑𝑓𝑟2 ∧ [𝑖 ′ → 𝑗 ′ ] ∈ 𝑑𝑓𝑟2 )) → [ ′
𝑖 →𝑗
𝑖 → 𝑗′
From 𝑒1 ⊒ 𝑒2 and definition A, we get:
(1a) ∀𝑖,𝑗∈𝑉𝐴𝑅𝑆,
𝑑∈𝔻
∶ [
𝑑
𝑑′
] ∈ 𝑑𝑓𝑟2 → (∃𝑑′ ∈𝔻 : 𝑑′ ≥ 𝑑 ∧ [
] ∈ 𝑑𝑓𝑟1 )
𝑖→𝑗
𝑖→𝑗
𝑖→𝑗
𝑑
𝑑′
(2a) ∀𝑖,𝑗,𝑖′ ,𝑗′ ∈𝑉𝐴𝑅𝑆 ∶ [ ′
′ ] ∈ 𝑑𝑓𝑟2 → ∃𝑑,𝑑 ′ ∈𝔻 : [𝑖 → 𝑗] ∈ 𝑑𝑓𝑟1 ∧ [𝑖 ′ → 𝑗 ′ ] ∈ 𝑑𝑓𝑟1
𝑖 →𝑗
𝑖→𝑗
𝑖→𝑗
𝑑
𝑑′
′
(3a) ∀𝑖,𝑗,𝑖′ ,𝑗′ ∈𝑉𝐴𝑅𝑆 ∶ ([ ′
] ∈ 𝑑𝑓𝑟1
′ ] ∈ 𝑑𝑓𝑟2 ∧ (∃𝑑, 𝑑 ≃ 1 ∶ [𝑖 → 𝑗 ] ∈ 𝑑𝑓𝑟1 ∧ [𝑖 ′ → 𝑗 ′ ] ∈ 𝑑𝑓𝑟1 )) → [ ′
𝑖 →𝑗
𝑖 → 𝑗′
We now show that 𝑑𝑓𝑟1 ⊒ 𝑑𝑓𝑟3 , by showing that all 3 formulae of definition A are true:
Formula 1: Let [
𝑑
] ∈ 𝑑𝑓𝑟3, be some data flow in 𝑑𝑓𝑟3.
𝑖→𝑗
From (1), there exists some [
Formula 2: Let [
𝑑′
] ∈ 𝑑𝑓𝑟2, s.t. 𝑑′ ≥ 𝑑, as required.
𝑖→𝑗
𝑖→𝑗
] ∈ 𝑑𝑓𝑟3 be some double data flow in 𝑑𝑓𝑟3.
𝑖′ → 𝑗′
From 𝑒2 ⊒ 𝑒3 and (2), ∃𝑑1 ,𝑑2 ∈𝔻 : [
From (1a), there exist [
Formula 3: Let [
𝑑
𝑑1
] ∈ 𝑑𝑓𝑟2 ∧ [ ′ 2 ′ ] ∈ 𝑑𝑓𝑟2.
𝑖→𝑗
𝑖 →𝑗
𝑑1′
𝑑′
] ∈ 𝑑𝑓𝑟1 and [ 2 ] ∈ 𝑑𝑓𝑟1 , as required.
𝑖→𝑗
𝑖→𝑗
𝑖→𝑗
] ∈ 𝑑𝑓𝑟3 be some double data flow in 𝑑𝑓𝑟3.
𝑖′ → 𝑗′
Assume that (a): ∃𝑑, 𝑑′ ≃ 1 ∶ [
𝑑
𝑑′
] ∈ 𝑑𝑓𝑟1 ∧ [ ′
] ∈ 𝑑𝑓𝑟1 .
𝑖→𝑗
𝑖 → 𝑗′
From (2), there are 𝑑1 , 𝑑2 such that (b):[
𝑑
𝑑1
] ∈ 𝑑𝑓𝑟2 ∧ [ ′ 2 ′ ] ∈ 𝑑𝑓𝑟2
𝑖→𝑗
𝑖 →𝑗
From (a) , (b) and (1a) and the fact that DFR does not contain duplicate data flows with different order, we get:
(b2) [
𝑑
𝑑1
] ∈ 𝑑𝑓𝑟2 ∧ [ ′ 2 ′ ] ∈ 𝑑𝑓𝑟2 ∧ 𝑑1 , 𝑑2 ≃ 1.
𝑖→𝑗
𝑖 →𝑗
From (b2) and (3), we get(c): [
𝑖→𝑗
𝑖→𝑗
] ∈ 𝑑𝑓𝑟1 , as required ∎
′
′ ] ∈ 𝑑𝑓𝑟2 . Lastly, from (c) and (3a) we get: [ ′
𝑖 →𝑗
𝑖 → 𝑗′
Proof of Lemma A1:
Let 𝑒1 =𝑎 𝑒2 . We will show that 𝑒1 ⊔ 𝑒2 ⊒ 𝑒1 , by showing that 𝐷𝐹𝑅(𝑒1 ⊔ 𝑒2 ) ⊒ 𝐷𝐹𝑅(𝑒1 ). This will suffice since
the pre and post-contexts of 𝑒1 and 𝑒2 are the same.
Formula 1: Let [
𝑑
] ∈ 𝐷𝐹𝑅(𝑒1 ).
𝑖→𝑗
From the effect of the ⊔ operator on DFRs (CiE08), there exists a data flow [
Such that: (𝑑′′ = 𝑑 ⊔ 𝑑′ ∧ [
𝑑′′
] ∈ 𝐷𝐹𝑅(𝑒1 ⊔ 𝑒2 ),
𝑖→𝑗
𝑑′
] ∈ 𝐷𝐹𝑅(𝑒2 )) ∨ (𝑑′′ = 𝑑).
𝑖→𝑗
Since 𝑑′′ ≥ 𝑑, formula 1 is satisfied.
Formula 2: Let [
[
𝑖→𝑗
] ∈ 𝐷𝐹𝑅(𝑒1 ). According to the DFR construction methods, there must be two data flows
𝑖′ → 𝑗′
𝑑
𝑑1
] , [ 2 ] ∈ 𝐷𝐹𝑅(𝑒1 ). It follows from formula 1 that there exist data flows
𝑖 → 𝑗 𝑖′ → 𝑗′
𝑑 ′
𝑑 ′
[ 1 ] , [ 2 ] ∈ 𝐷𝐹𝑅(𝑒1 ⊔ 𝑒2 ), as required.
𝑖 → 𝑗 𝑖′ → 𝑗′
Formula 3: Let [
𝑖→𝑗
] ∈ 𝐷𝐹𝑅(𝑒1 ).
𝑖′ → 𝑗′
Assume that (a): ∃𝑑, 𝑑′ ≃ 1 ∶ [
𝑑
𝑑′
] ∈ 𝐷𝐹𝑅(𝑒1 ⊔ 𝑒2 ) ∧ [ ′
] ∈ 𝐷𝐹𝑅(𝑒1 ⊔ 𝑒2 ).
𝑖→𝑗
𝑖 → 𝑗′
From the definition of the ⊔ operator on DFRs [CiE08],
𝐷𝐹𝑅(𝑒1 ) ⊔ 𝐷𝐹𝑅(𝑒2 ) = (𝑀1, 𝑅1) ⊔ (𝑀2, 𝑅2)𝑑𝑒𝑓 = (𝑀1 ⊔ 𝑀2, (𝑅1 ∪ 𝑅2) ∩ 𝐶2(𝐀𝟏(𝑀1 ⊔ 𝑀2))),
where 𝑀𝑖 is the set of all regular data flows 𝑅𝑖 is the set of all double flows in 𝐷𝐹𝑅(𝑒𝑖 ), and 𝐶2 , 𝐴1 are as defined
in [CiE08].
Since [
𝑖→𝑗
𝑖→𝑗
] ∈ 𝑅1, it follows that [ ′
] ∈ (𝑅1 ∪ 𝑅2 ) and from (a) we also get that
𝑖′ → 𝑗′
𝑖 → 𝑗′
𝑖→𝑗
𝑖→𝑗
[′
] ∈ 𝐶2(𝐀𝟏(𝑀1 ⊔ 𝑀2)), therefore [ ′
] ∈ 𝐷𝐹𝑅(𝑒1 ⊔ 𝑒2 ), as required ∎
𝑖 → 𝑗′
𝑖 → 𝑗′
Proof of Lemma A3:
We show by structural induction on the core language Abstract Syntax Tree that the lemma is true.
Base: we start from the core language AST leaves. The possible leaves are:
"𝑋𝑖 ∶= 𝑒" or "𝑆𝑘𝑖𝑝"
1. 𝐶 = 𝑆𝑘𝑖𝑝
Let 𝐶𝐺 = 𝒜(𝑆𝑘𝑖𝑝, 𝑝𝑐), and 𝐶𝐺 𝑠 = 𝒜 𝑠 (𝑆𝑘𝑖𝑝, 𝑝𝑐), for some reset context 𝑝𝑐.
Both algorithms do exactly the same for the skip command (no subsumption takes place), and therefore:
𝐶𝐺 = 𝒜(𝑆𝑘𝑖𝑝, 𝑝𝑐) = 𝒜 𝑠 (𝑆𝑘𝑖𝑝, 𝑝𝑐) = 𝐶𝐺 𝑠 .
2. 𝐶 = 𝑋𝑖 ∶= 𝑒
We consider the result of 𝒜 and 𝒜 𝑠 on the assignment command with a single pre-context 𝑃.
𝒜 computes new arcs according to the assignment command inference rules (section 4.2 in [BA10]), therefore
all arcs computed can only be of the form (𝑃, 𝑃̂) where 𝑃̂ is some post context.
Let 𝐶𝐺 = 𝒜(𝑋𝑖 ∶= 𝑒, 𝑃), and 𝐶𝐺 𝑠 = 𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, 𝑃), for some variable 𝑋𝑖 , expression 𝑒, and a single resetcontext 𝑃.
Let (𝑃, 𝑃̂) ∈ 𝐶𝐺 be some arc in the context-graph computed by 𝒜(𝑋𝑖 ∶= 𝑒, 𝑃).
Since 𝒜 𝑠 follows the same inference rules as 𝒜, 𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, 𝑃) computes the exact same arc (𝑃, 𝑃̂) before
applying subsumption.
If (𝑃, 𝑃̂) ∈ 𝐶𝐺 𝑠 , then it was not subsumed by any other arc, and the lemma is satisfied.
Otherwise, (𝑃, 𝑃̂) ∉ 𝐶𝐺 𝑠 , which means that it was subsumed by some other arc. From definition C and the
̂ ) ∈ 𝐶𝐺 𝑠 s.t.
transitivity of the ⊒ relation for context-graph arcs(Lemma A0), there exists some arc (𝑃, 𝑃′
̂ ) ⊒ (𝑃, 𝑃̂).
(𝑃, 𝑃′
Since 𝑃 is general, it follows that (2.1):

For any single pre-context 𝑃 and computed arc 𝑒1 = (𝑃, 𝑃̂ ) ∈ 𝐶𝐺,
̂ ) ∈ 𝐶𝐺 𝑠 s.t. 𝑒2 ⊒ 𝑒1 .
there exists an arc 𝑒2 = (𝑃, 𝑃′
Given a pre-context set 𝑝𝑐 = {𝑃1 , 𝑃2 , … , 𝑃𝑛 }, the effect of 𝒜 on an assignment command can be described as
follows:
𝒜(𝑋𝑖 ∶= 𝑒, 𝑝𝑐) = 𝒜(𝑋𝑖 ∶= 𝑒, {𝑃1 , 𝑃2 , … , 𝑃𝑛 }) =
= 𝒜(𝑋𝑖 ∶= 𝑒, 𝑃1 )⨆𝒜(𝑋𝑖 ∶= 𝑒, 𝑃2 )⨆ ⋯ ⨆ 𝒜(𝑋𝑖 ∶= 𝑒, 𝑃𝑛 )
The reason is, that the set of arcs computed for any single pre-context 𝑃𝑖 are disjoint from the set of arcs
computed for any other pre-context 𝑃𝑗 , 𝑖 ≠ 𝑗, so the effect of the LUB operator is simply to merge disjoint sets
of arcs into a single graph.
We now consider the result of 𝒜 𝑠 on the same assignment command, given the same pre-contexts set 𝑝𝑐:
𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, 𝑝𝑐) = 𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, {𝑃1 , 𝑃2 , … , 𝑃𝑛 }) =
= 𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, 𝑃1 )⨆𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, 𝑃2 )⨆ ⋯ ⨆ 𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, 𝑃𝑛 )
It is apparent from (2.1) that for any 1 ≤ 𝑖 ≤ 𝑛, 𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, 𝑃𝑖 ) ⊒ 𝒜(𝑋𝑖 ∶= 𝑒, 𝑃𝑖 ), and since the computed
arcs of each pre-context are disjoint it follows that 𝒜 𝑠 (𝑋𝑖 ∶= 𝑒, 𝑝𝑐) ⊒ 𝒜(𝑋𝑖 ∶= 𝑒, 𝑝𝑐), as required.
Step: We now examine the core language compound commands. The possible compound commands are:
1. "𝐶ℎ𝑜𝑜𝑠𝑒 𝐶1 𝑜𝑟 𝐶2 "2. "𝐶1 ; 𝐶2 "3. "𝐿𝑜𝑜𝑝 𝑋𝑖 { 𝐶 }"
1. 𝐶 = 𝐶ℎ𝑜𝑜𝑠𝑒 𝐶1 𝑜𝑟 𝐶2
Let 𝐶𝐺1 = 𝒜(𝐶1 , 𝑝𝑐),𝐶𝐺1𝑠 = 𝒜 𝑠 (𝐶1 , 𝑝𝑐) be the graphs computed from 𝐶1 by 𝒜 and 𝒜 𝑠 respectively.
Similarly, let 𝐶𝐺2 ,𝐶𝐺2𝑠 be the graphs computed from 𝐶2 and the same pre-contexts 𝑝𝑐, by𝒜 and 𝒜 𝑠
respectively.
From the induction hypothesis, it follows that:
1.1 𝐶𝐺𝑘𝑠 ⊒ 𝐶𝐺𝑘 , 𝑘 = 1,2
Let 𝐶𝐺 = 𝒜(𝐶, 𝑝𝑐), 𝐶𝐺 𝑠 = 𝒜 𝑠 (𝐶, 𝑝𝑐) be the result graphs computed by 𝒜 and 𝒜 𝑠 respectively, from the
"𝐶ℎ𝑜𝑜𝑠𝑒 𝐶1 𝑜𝑟 𝐶2 " command.
From the semantics of the "𝐶ℎ𝑜𝑜𝑠𝑒 𝐶1 𝑜𝑟 𝐶2 " command:
𝐶𝐺 = 𝐶𝐺1 ⊔ 𝐶𝐺2
𝐶𝐺 𝑠 = max(𝐶𝐺1𝑠 ⊔ 𝐶𝐺2𝑠 )
⊒
Let 𝑒 ∈ 𝐶𝐺 = 𝐶𝐺1 ⊔ 𝐶𝐺2 . There can be 2 possibilities:
a.
𝑒 = 𝑒1 ⊔ 𝑒2 , 𝑠. 𝑡. 𝑒1 ∈ 𝐶𝐺1 ∧ 𝑒2 ∈ 𝐶𝐺2
In this case, there exist arcs 𝑒1𝑠 ∈ 𝐶𝐺1𝑠 and 𝑒2𝑠 ∈ 𝐶𝐺2𝑠 , s.t. 𝑒1𝑠 ⊒ 𝑒1 and 𝑒2𝑠 ⊒ 𝑒2 .
It follows that there exists an arc 𝑒 𝑠 ∈ (𝐺1𝑠 ⊔ 𝐶𝐺2𝑠 ) s.t. 𝑒 𝑠 = 𝑒1𝑠 ⊔ 𝑒2𝑠 . From Lemma A2, 𝑒 𝑠 ⊒ 𝑒.
If 𝑒 𝑠 ∈ 𝐶𝐺 𝑠 then the lemma is satisfied.
Otherwise, 𝑒 𝑠 is subsumed by some other arc. From lemma A0 there exist some arc 𝑒̂ 𝑠 ∈ 𝐶𝐺 𝑠
which subsumes 𝑒 𝑠 . It follows that 𝑒̂ 𝑠 ⊒ 𝑒 𝑠 ⊒ 𝑒, as required.
b.
𝑒 ∈ 𝐶𝐺𝑘 ∧ (∄𝑒 ′ ∈ 𝐶𝐺𝑙 ∶ 𝑒 =𝑎 𝑒 ′ )
𝑘, 𝑙 ∈ {1,2}, 𝑘 ≠ 𝑙
w.l.o.g., (for symmetry) we assume that 𝑒 ∈ 𝐶𝐺1 , 𝑒 = (𝑃, 𝑄).
It follows that there exists an arc 𝑒1𝑠 ∈ 𝐶𝐺1𝑠 s.t. 𝑒1𝑠 ⊒ 𝑒. From the definition of the ⊔ operator, there
exists an arc 𝑒 𝑠 ∈ (𝐶𝐺1𝑠 ⊔ 𝐶𝐺2𝑠 ) s.t. 𝑒 𝑠 = 𝑒1𝑠 ⊔ 𝑒2𝑠 (take 𝑒2𝑆 empty if no such arc in 𝐶𝐺2𝑠 ). Therefore,
from lemma A2, 𝑒 𝑆 ⊒ 𝑒1𝑠 ⊒ 𝑒.
If 𝑒 𝑠 ∈ 𝐶𝐺 𝑠 , the lemma is satisfied.
Otherwise 𝑒 𝑆 is subsumed by some other arc. From lemma A0 there exist some arc 𝑒̂ 𝑠 ∈ 𝐶𝐺 𝑠
which subsumes 𝑒 𝑠 . It follows that 𝑒̂ 𝑠 ⊒ 𝑒 𝑠 ⊒ 𝑒, as required.
2. "𝐶1 ; 𝐶2 " :
Let 𝐶𝐺1 ,𝐶𝐺1𝑠 be the graphs computed from 𝐶1 by 𝒜 and 𝒜 𝑠 respectively.
Similarly, let 𝐶𝐺2 ,𝐶𝐺2𝑠 be the graphs computed from 𝐶2 by 𝒜 and 𝒜 𝑠 respectively.
From the induction assumption, it follows that:
2.1 ∀𝑖,𝑗∈𝑉𝐴𝑅𝑆(𝐶𝐺𝑘 ) ∶ 𝑑𝑚𝑎𝑥 (𝐶𝐺𝑘𝑠 , 𝑖 → 𝑗) ≥ 𝑑𝑚𝑎𝑥 (𝐶𝐺𝑘 , 𝑖 → 𝑗), 𝑓𝑜𝑟 𝑘 = 1 𝑜𝑟 2
Let 𝐶𝐺, 𝐶𝐺 𝑠 be the result graphs computed by 𝒜 and 𝒜 𝑠 respectively, from the "𝐶1 ; 𝐶2 " command.
From the semantics of the "𝐶1 ; 𝐶2 " command:
𝐶𝐺 = 𝐶𝐺1 ⋅ 𝐶𝐺2 𝐶𝐺 𝑠 = 𝐶𝐺1𝑠 ⋅ 𝐶𝐺2𝑠 .
𝑑
Now, let [
] ∈ (𝑃, 𝑅) be some worst-case data flow where (𝑃, 𝑅) ∈ 𝐶𝐺.i.e. 𝑑𝑚𝑎𝑥 (𝐶𝐺, 𝑖 → 𝑗) = 𝑑.
𝑖→𝑗
From the definition of the ⋅ operator, there exists an arc (𝑃, 𝑄) ∈ 𝐶𝐺1 and an arc (𝑄, 𝑅) ∈ 𝐶𝐺2 . Again from
the ⋅ operator definition, either:
2.3[
𝑑
𝑑
𝑑
𝑑
𝑑
] = [ 1 ] ⋅ [ 2 ] where [ 1 ] ∈ (𝑃, 𝑄), [ 2 ] ∈ (𝑄, 𝑅) and 𝑑 = 𝑑1 ⊔ 𝑑2
𝑖→𝑗
𝑘→𝑗
𝑖→𝑘 𝑘→𝑗
𝑖→𝑘
Or:
𝑘→𝑗
𝑘→𝑗
𝑑
𝑖→𝑘
𝑖→𝑘
2.4 [
]=[
]⋅[
] where [
] ∈ (𝑃, 𝑄), [
] ∈ (𝑄, 𝑅), and 𝑑 = 2
𝑖→𝑗
𝑘′ → 𝑗
𝑖 → 𝑘′ 𝑘′ → 𝑗
𝑖 → 𝑘′
It follows that there exists an arc (𝑃, 𝑄 ′ ) ∈ 𝐶𝐺1𝑠 and a data flow
Since any new Context Graph is created by a join or composition of 𝐶 𝑐𝑢𝑟𝑟 , the current command, with a Context
Graph that is the result of:
1. The next command 𝐶 𝑛𝑒𝑥𝑡 analysis (forward composition)
2. The previous command𝐶 𝑝𝑟𝑒𝑣 analysis (reverse composition)
3. The other branch command 𝐶 𝑒𝑙𝑠𝑒 in an "If {𝐶 𝑐𝑢𝑟𝑟 } else {𝐶 𝑒𝑙𝑠𝑒 }" block analysis (join)1
Or by:
4. Loop Correctionof 𝐶 𝑐𝑢𝑟𝑟 2
It will suffice to show(by structural induction) that any worst-case data flow generated at any stage by any of the
above actions due to data flows from the subsumed arc will still be generated on some arc.
𝑑
𝑑⨆𝑑′
Case 1: Let [
] be a worst-case data flow on arc (𝑃, 𝑅), generated by the composition of flow [
]from
𝑖→𝑗
𝑖→𝑗
𝑑′
(𝑃, 𝑄) ∈ 𝐶𝐺(𝐶 𝑐𝑢𝑟𝑟 ) and flow [
] from (𝑄, 𝑅) ∈ 𝐶𝐺(𝐶 𝑛𝑒𝑥𝑡 ). The edge (𝑃, 𝑅) will not be generated due to
𝑖→𝑗
the subsumption of edge (𝑃, 𝑄). We show that the worst-case data flows of edge (𝑃, 𝑅) still persist:
Due to the algorithm, the pre-contexts for the analysis of𝐶 𝑛𝑒𝑥𝑡 are the post contexts of 𝐶𝐺(𝐶 𝑐𝑢𝑟𝑟 ), so 𝑄′ is a
pre-context to the analysis of 𝐶 𝑛𝑒𝑥𝑡 . Since 𝑄 ′ ⊂ 𝑄, there exists a post-context 𝑅′ s.t. (𝑄 ′ , 𝑅 ′ ) ∈
𝐶𝐺(𝐶 𝑛𝑒𝑥𝑡 )and𝑅 ′ ⊆ 𝑅. It follows that 𝐷𝐹𝑅(𝑄, 𝑅) ⊆ 𝐷𝐹𝑅(𝑄′, 𝑅′)(More data flows can be deduced from the
same command when less variables are zero).
So [
𝑑′
𝑑⨆𝑑′
] on
] ∈ 𝐷𝐹𝑅(𝑄 ′ , 𝑅 ′ ), and the composition of (𝑃, 𝑄 ′ ) ⋅ (𝑄 ′ , 𝑅 ′ )yields the worst case data flow [
𝑖→𝑗
𝑖→𝑗
(𝑃, 𝑅 ′ ), as required.
Case 2: Similar to case 1 with reverse reasoning - still consider a worst-case data flow generated by the
composition, but rely on the fact that P is a post context of 𝐶𝐺(𝐶 𝑝𝑟𝑒𝑣 ).
Case 3: By its definition, the Join operation preserves worst-case data flows of all edges of joined graphs – in
essence, it does no create worst case data flows by itself, but preserves all worst case data flows computed in
any of the joined graphs.
Case 4: Loop correction only adds new data flows to existing edges – it does not create new edges or remove
any existing data flows (unless the new data flow has a higher value than an existing data flow, in which case the
worst case data flow will have at least the worst case data flow value from before applying the Loop Correction.
Converse direction – same principle, but use different order relation (which? Should it be different?, should
consider Loop Correction in the definition of the order relation).
Can also be a block of the form "If {𝐶 𝑒𝑙𝑠𝑒 } else {𝐶 𝑐𝑢𝑟𝑟 }"– it is treated the same way by the join operation.
The Loop "m-iterations" analysis stage is not referred here since it is interpreted as a series of compositions and joins
1
2