Differences

This shows you the differences between two versions of the page.

--- sav07_lecture_3_skeleton [2007/03/20 14:48]
vkuncak
+++ sav07_lecture_3_skeleton [2007/03/20 21:21]
vkuncak
@@ Line 1: / Line 1: @@
 ====== Lecture 3 (Skeleton) ======
+===== Converting programs (with simple values) to formulas =====
 ==== Context ====
@@ Line 6: / Line 9: @@
   * represent programs using guarded command language, e.g. desugaring of 'if' into non-deterministic choice and assume
   * give meaning to guarded command language statements as relations
-  * we can represent relations using set comprehensions; if our program r has two state components, we can represent its meaning R(r) as
+  * we can represent relations using set comprehensions; if our program c has two state components, we can represent its meaning R( c ) as $\{((x_0,y_0),(x,y)) \mid F  \}$, where F is some formula that has x,y,x_0,y_0 as free variables.
-<latex>
-\{((x_0,y_0),(x,y)) \mid F \}
+  * this is what I mean by ''simple values'': later we will talk about modeling pointers and arrays, but we will still use this as a starting point.
-</latex>
-    where F is some formula that has x,y,x_0,y_0 as free variables.
-Our goal is to find rules for computing R(r) that are
+Our goal is to find rules for computing R( c ) that are
   * correct
   * efficient
-  * create formulas that we can prove later
+  * create formulas that we can effectively prove later
+What exactly do we prove about the formula R( c ) ?
+We prove that this formula is **valid**:
+  R( c ) -> error=false
@@ Line 59: / Line 67: @@
 when c is a basic command.
@@ Line 80: / Line 90: @@
 We can apply these rules to reduce the size of formulas.
-==== Papers ====
+==== Approximation ====
+If (F -> G) is value, we say that F is stronger than F and we say G is weaker than F.
+When a formula would be too complicated, we can instead create a simpler approximate formula.  To be sound, if our goal is to prove a property, we need to generate a *larger* relation, which corresponds to a weaker formula describing a relation, and a stronger verification condition.  (If we were trying to identify counterexamples, we would do the opposite).
+We can replace "assume F" with "assume F1" where F1 is weaker.  Consequences:
+  * omtiting complex if conditionals (assuming both branches can happen - as in most type systems)
+  * replacing complex assignments with arbitrary change to variable: because x=t is havoc(x);assume(x=t) and we drop the assume
+This idea is important in static analysis.
+==== Symbolic execution ====
+Symbolic execution converts programs into formulas by going forward.  It is therefore somewhat analogous to the way an [[interpreter]] for the language would work.  It is based on the notion of strongest postcondition.
+==== Weakest preconditions ====
+While symbolic execution computes formula by going forward along the program syntax tree, weakest precondition computes formula by going backward.
+===== Proving quantifier-free linear arithmetic formulas =====
+===== Papers =====
   * Verification condition generation in Spec#: http://research.microsoft.com/~leino/papers/krml157.pdf
@@ Line 88: / Line 124: @@
   * Presburger Arithmetic (PA) bounds: {{papadimitriou81complexityintegerprogramming.pdf}}
   * Specializing PA bounds: http://www.lmcs-online.org/ojs/viewarticle.php?id=43&layout=abstract