Differences

This shows you the differences between two versions of the page.

--- sav07_lecture_3_skeleton [2007/03/21 09:25]
vkuncak
+++ sav07_lecture_3_skeleton [2007/03/21 10:45]
vkuncak
@@ Line 102: / Line 102: @@
 This idea is important in static analysis.
@@ Line 108: / Line 109: @@
 Symbolic execution converts programs into formulas by going forward.  It is therefore somewhat analogous to the way an [[interpreter]] for the language would work.  It is based on the notion of strongest postcondition.
+\begin{equation*}
+  sp(P,r) = \{ s_2 \mid \exists s_1.\ s_1 \in P \land (s_1,s_2) \in r \}
+\end{equation*}
 ==== Weakest preconditions ====
@@ Line 127: / Line 129: @@
 Alternative:
   * decide that you will only loop for formulas of restricted form, as in abstract interpretation and data flow analysis (next week)
 ===== Proving quantifier-free linear arithmetic formulas =====
+Suppose that we obtain (one or more) verification conditions of the form
+\begin{equation*}
+ F\ \rightarrow\ (\mbox{error}=\mbox{false})
+\end{equation*}
+whose validity we need to prove.  We here assume that F contains only
+Note: we can check satisfiability of $F\ \land\ (\mbox{error}=\mbox{true})$.
+==== Quantifier Presburger arithmetic ====
+Here is the grammar:
+  var = x | y | z | ...                    (variables)
+  K = ... | -2 | -1 | 0 | 1 | 2 | ...      (integer constants)
+  T ::= var | T + T | K * T                (terms)
+  A ::= T=T | T <= T                       (atomic formulas)
+  F ::= F & F |  F|F  |  ~F                (formulas)
+To get full Presburger arithmetic, allow existential and universal quantifiers in formula as well.
+Note: we can assume we have boolean variables (such as 'error') as well, because we can represent them as 0/1 integers.
+Satisfiability of quantifier-free Presburger arithmetic is decidable.
+Proof: small model theorem.
+==== Small model theorem for Quantifier-Free Presburger Arithmetic (QFPA) ====
+First step: transform to disjunctive normal form.
+Next: reduce to integer linear programming:
+\begin{equation*}
+  A\vec x = \vec b, \qquad \vec x \geq \vec 0
+\end{equation*}
+where $A \in {\cal Z}^{m,n}$ and $x \in {\cal Z}^n$.
+Then solve integer linear programming (ILP) problem
+  * [[wk>Integer Linear Programming]]
+  * online book chapter on ILP
+  * [[http://www.gnu.org/software/glpk/|GLPK]] tool
+We can prove small model theorem for ILP - gives bound on search.
+Short proof by {{papadimitriou81complexityintegerprogramming.pdf|Papadimitriou}}:
+  * solution of Ax=b (A regular) has as components rationals of form p/q with bounded p,q
+  * duality of linear programming
+  * obtains bound $M = n(ma)^{2m+1}$, which needs $(2m+1)(\log n + \log m + \log a)$ bits
+  * we could encode the problem into SAT: use circuits for addition, comparison etc.
+Note: if small model theorem applies to conjunctions, it also applies to arbitrary QFPA formulas.
+Moreover, one can improve these bounds.  One tool based on these ideas is [[http://www.cs.cmu.edu/~uclid/|UCLID]].
+Alternative: enumerate disjuncts of DNF on demand, each disjunct is a conjunction, then use ILP techniques (often first solve the underlying linear programming problem over reals).  Many SMT tools are based on this idea (along with Nelson-Oppen combination: next class).
+  * [[http://www.cs.nyu.edu/acsys/cvc3/download.html|CVC3]] (successor of CVC Lite)
+  * [[http://combination.cs.uiowa.edu/smtlib/|SMT-LIB]] Standard for formulas, competition
+==== Full Presburger arithmetic ====
+Full Presburger arithmetic is also decidable.
+Approaches:
+  * Quantifier-Elimination (Omega tool from Maryland) - see homework
+  * Automata Theoretic approaches: LASH, MONA (as a special case)
 ===== Papers =====