Model Checking Erlang Programs – Abstracting Recursive Function Calls

Abstract

We present an approach for the verification of Erlang programs using abstract interpretation and model checking. In previous work we defined a framework for data abstraction for Erlang. An abstract operational semantics for this framework preserves all paths of the standard operational semantics. Hence, the abstraction is safe for all properties that have to hold on all paths of a system, like properties in LTL. The proof can be automated with model checking if the abstract operational semantics is a finite transition system. But finiteness cannot be guaranteed because of non-tail recursive function calls. Even for finite domain abstract interpretations we get infinite state systems and model checking is undecidable. In this paper we formalize an abstraction of the control-flow. It replaces the recursive calls in non-tail positions by jumps to the last call of the same function. The corresponding returns are replaced by jumps to the possible return points.We have implemented this approach as a prototype and are able to prove properties like mutual exclusion or the absence of deadlocks and lifelocks for some Erlang programs.